CVE-2026-90444 describes an OS command injection vulnerability (CWE-78) in CISA Malcolm versions prior to 26.06.0. The vulnerability arises because the file-transfer interface accepts filenames with shell metacharacters from authenticated users without restriction. Subsequently, an automated system command is constructed and executed using the uploaded filename, enabling arbitrary command execution with the privileges of that process. This can compromise log data integrity and confidentiality and may facilitate further internal network compromise.

An authenticated attacker can execute arbitrary operating system commands with the privileges of the automated process handling uploaded filenames. This allows unauthorized reading and modification of ingested log data and could provide a foothold for lateral movement within the internal network, potentially escalating the impact beyond the initial system.

No patch or official fix information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the file-transfer interface to trusted users only and monitor for suspicious activity related to file uploads and command execution.