Executive assessment
Today's brief leads with Multiple vulnerabilities in CISA Malcolm. All 4 selected findings retain their own technical scope, action, observed status, and evidence limits.
Finding 01 — Multiple vulnerabilities in CISA Malcolm
What changed: CISA Malcolm <=v26.07.1 and <=v26.08.0 are affected. Weaknesses: Authentication Bypass by Spoofing; Authentication Bypass Using an Alternate Path or Channel; Cross-Site Request Forgery; Incorrect Authorization; Server-Side Request Forgery.
Technical evidence: CVE-2026-107337; CVSS v3.1 7.1; weakness CWE-352; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Block direct external access to port 8005, restrict Arkime's userAuthIps to the nginx container, and bind viewHost to the Docker bridge IP or localhost. Exclude FETCH_REMOTE_FILE from FilePond's route handlers. ([raw.githubusercontent.com](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-280-01.json), [api.github.com](https://api.github.com/repos/cisagov/Malcolm/security-advisories/GHSA-86h3-7rf8-8j34), [api.github.com](https://api.github.com/repos/cisagov/Malcolm/security-advisories/GHSA-w8gq-4v5x-xrrm), +1 more)
Fix: v26.08.0 for CVE-2026-107336, CVE-2026-107361, CVE-2026-107337, CVE-2026-107335 and CVE-2026-107334; v26.09.0 for CVE-2026-107333 and CVE-2026-107362. ([raw.githubusercontent.com](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsa-26-280-01.json))
Panel assessment: Patch Malcolm to v26.08.0 or v26.09.0 this week; these are authentication bypass issues in an OT sensor with no public exploitation yet but significant value if misconfigurations exist. Compromise grants unauthenticated API access to network logs, the capture data Malcolm preserves. Check immediately: is port 8005 restricted to internal Docker networks or exposed externally? (priority: this week)
Action: Map CVE-2026-107337 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-advisories/icsa-26-280-01)
Finding 02 — Thermo Fisher Torrent Suite Software: Path Traversal
What changed: Successful exploitation of this vulnerability could allow an attacker to read arbitrary files on the Torrent Server.
Technical evidence: CVE-2026-107777; CVSS v4.0 7.1; weakness CWE-22; technical confidence High.
Why it matters: The High priority moves this beyond routine tracking and requires exposure validation, remediation, and compromise assessment.
Analyst note: Block public Internet access and place components behind a properly configured firewall or secured VLAN. Change default login credentials immediately, or disable the account if it is unused. CISA reports that no known public exploitation specifically targeting this vulnerability has been reported to it. ([documents.thermofisher.com](https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/Ion_OneTouch_2_and_Torrent_Suite_Software.pdf), [raw.githubusercontent.com](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsma-26-288-01.json))
Affected: Torrent Suite Software <=5.18 ([raw.githubusercontent.com](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsma-26-288-01.json))
Fix: Torrent Suite Software 5.22 or later ([raw.githubusercontent.com](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/OT/white/2026/icsma-26-288-01.json))
Action: Map CVE-2026-107777 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: cisa.gov](https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-288-01)
Finding 03 — Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
What changed: ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: The cited source reports a breach of the vendor's service; exposure depends on use of that service rather than on exploitation of a single vulnerability.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
fixed version or patch state unknown
[Evidence source: bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/)
Finding 04 — MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
What changed: Cybersecurity researchers have discovered a malicious npm package that's part of a recently disclosed software supply chain attack campaign dubbed MALFEX. The package, named "imgdecode," was uploaded to the package registry on September 30, 2026, by a user named "malfexteste8." It has been downloaded 979 times as of writing and is still available on npm as of writing.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: The cited source reports an active supply-chain compromise; exposure depends on use of the affected packages rather than exploitation of a single vulnerability.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
fixed version or patch state unknown
[Evidence source: thehackernews.com](https://thehackernews.com/2026/10/malfex-npm-package-imgdecode-hides.html)