CVE-2026-90456

Use of default credentials in Malcolm

State: Published
Severity: 9.2 Critical
Published: Sep 11, 2026
Updated: Oct 2, 2026
Reserved: Sep 11, 2026

Description

An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative password. A deployment that copies this example file into active configuration without running the setup routine that regenerates credentials will expose that component's administrative interface to anyone aware of the default value.

Scores

CVSS	Score	Vector	Source
4.0	9.2 Critical	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	icscert
3.1	8.1 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H	icscert

Weaknesses

CWE-1392 Use of default credentials

Affected Products

Product	Versions
MalcolmCISA	before v26.06.0Affected v26.06.0Not affected

References

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-254-01.jsongovernment-resourcevendor-advisory
https://www.cisa.gov/news-events/ics-advisories/icsa-26-254-01

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.