ETK-2026-717Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-717",
  "cve_id": null,
  "display_id": "ETK-2026-717",
  "ghsa_id": "GHSA-w2jh-h3pq-273j",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Default configuration PIN in Malcolm Arkime WISE",
  "summary": "Malcolm deployments using Arkime WISE may retain a publicly known PIN for WISE configuration changes. An attacker who can reach the enabled WISE interface and satisfy other access controls could alter enrichment settings, potentially affecting lookup behavior and investigation results.",
  "mitigation": "Upgrade Malcolm to version 26.10.0. Replace any example WISE PIN with a unique secret, and disable or restrict access to WISE where it is not required.",
  "vendor": "other / arkime / wise",
  "product": "other / arkime / wise:idaholab/Malcolm",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 26.09.0"
      ],
      "ecosystem": "other / arkime / wise",
      "fixed_versions": [
        "26.10.0"
      ],
      "package_name": "idaholab/Malcolm",
      "purl": null
    }
  ],
  "cwes": [
    798
  ],
  "cvss_score": 7.1,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 33.89525855,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-05T21:19:11+00:00",
      "days": -15.590298842280093,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T11:29:12.843072+00:00",
      "url": "https://github.com/cisagov/Malcolm/security/advisories/GHSA-w2jh-h3pq-273j"
    }
  }
}