CVE-2026-90455

Awaiting Analysis Awaiting Analysis - Queue

BaseFortify

Publication date: 2026-09-11

Last updated on: 2026-10-02

Assigner: ICS-CERT

Description

A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing the earlier, vulnerable version into a log-processing component. The only code path in that component using the library issues a request to a single fixed, trusted vendor URL at initialization and does not process attacker-controlled input through the library, limiting practical exploitability of the reintroduced version in this context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-10-02

Generated

2026-10-19

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-18

NVD

CVE-2026-90455

Affected Vendors & Products

Vendor	Product	Version / Range
CISA	Malcolm	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

A log-processing component reverted to an older, vulnerable HTTP client library after a prior update. The vulnerable version was reintroduced despite a previous fix. The only code path using this library sends a request to a fixed vendor URL during initialization and does not process attacker-controlled input, reducing exploitability.

Detection Guidance

Detection may involve checking the version of the HTTP client library used in the log-processing component. Compare the installed version against the remediated version mentioned in the update. Review logs for any unusual network activity during initialization, though exploitability is limited.

Impact Analysis

The impact is limited due to the lack of attacker-controlled input and the fixed vendor URL. Exploitation is unlikely in practice, but the vulnerable library could theoretically be exploited if other conditions are met.

Compliance Impact

The vulnerability reintroduces an older HTTP client library with known issues into a log-processing component. However, the only code path using this library sends requests to a fixed, trusted vendor URL during initialization without processing attacker-controlled input. This limits practical exploitability, reducing the risk of unauthorized data access or processing that could violate GDPR or HIPAA.

Mitigation Strategies

Reapply the update that raises the HTTP client library to the remediated version. Ensure the log-processing component uses the corrected library version and monitor for any signs of unusual activity during initialization.

Hi! I’m here to help you understand CVE-2026-90455. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70