Intelligence online17 sources monitored16 actively exploited 7d25 published 24hChecked recently
Vulnerability record

CVE-2026-107337

HighNo known exploitation

Patch status

No official fix confirmed yet

Until a fix ships, follow the vendor's mitigations, limit exposure of affected systems, and watch this record for a patch.

Description

The Malcolm kiosk Flask application exposes a POST /script_call/<script> endpoint with zero authentication and wildcard CORS (CORS(app)). An attacker can force the operator's browser to execute arbitrary management commands via CSRF, including control.py --wipe which permanently deletes all captured network traffic and forensic logs, or control.py --stop which blinds the security monitoring.

Source: NIST National Vulnerability Database. Official vulnerability data, reproduced as published.

Intelligence timeline

Developments from the last 30 days, newest first.

  1. CVSS scoredUpdate

    CVE-2026-107337 scored CVSS 7.1

    Basis: NIST National Vulnerability Database

Coverage

HighReview

CISA Malcolm

CISA Cybersecurity AdvisoriesEnterpriseDevelopersCritical infra

References

  • github.com https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-280-01.json
  • github.com https://github.com/cisagov/Malcolm/security/advisories/GHSA-w8gq-4v5x-xrrm