https://vulnerability.circl.lu/sightings/feed 2026-09-17T23:15:13.237130+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/6f98727f-bb43-4238-b80e-02011b249a60/export 2026-09-17T23:15:13.259397+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6f98727f-bb43-4238-b80e-02011b249a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mvppnbja452r", "content": "Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution (CVE-2026-89026) #appsec", "creation_timestamp": "2026-09-17T13:02:47.465917Z"} 2026-09-17T13:02:47.465917+00:00 https://vulnerability.circl.lu/sighting/667b5e32-8dba-4abd-9faf-73f9bd3b8049/export 2026-09-17T23:15:13.261272+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "667b5e32-8dba-4abd-9faf-73f9bd3b8049", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvpinowfvw2u", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): unauthenticated RCE in Issabel Framework PBX via hard-coded credentials, actively exploited in the wild. Patch now.\n\nhttps://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-17T10:57:45.590312Z"} 2026-09-17T10:57:45.590312+00:00 https://vulnerability.circl.lu/sighting/c627b381-3c3b-4265-a524-891cd0301a05/export 2026-09-17T23:15:13.261411+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "c627b381-3c3b-4265-a524-891cd0301a05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvoqim3lhm27", "content": "Critical Issabel Framework flaw CVE-2026-89026 (CVSS 9.8) is being exploited to forge JWT tokens and run OS commands without authentication. Patch released Aug 1, 2026. #Issabel #CVE-2026-89026 #Shadowserver", "creation_timestamp": "2026-09-17T03:45:25.765336Z"} 2026-09-17T03:45:25.765336+00:00 https://vulnerability.circl.lu/sighting/17da7a35-3744-4ec9-b20b-dc4db8a8876c/export 2026-09-17T23:15:13.261523+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "17da7a35-3744-4ec9-b20b-dc4db8a8876c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "content": "A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation.\n\nThe vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded", "creation_timestamp": "2026-09-17T01:00:40.188294Z"} 2026-09-17T01:00:40.188294+00:00 https://vulnerability.circl.lu/sighting/97857edd-68fc-4a50-93bf-ab2031c8145b/export 2026-09-17T23:15:13.261639+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "97857edd-68fc-4a50-93bf-ab2031c8145b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "exploited", "source": "https://t.me/thehackernews/10077", "content": "\u203c\ufe0f Attackers are exploiting a critical Issabel Framework flaw.\n\nCVE-2026-89026 uses a hard-coded JWT signing key, letting unauthenticated remote attackers forge tokens and execute OS commands as the Asterisk user. A fix is available.\n\nHow the flaw works: https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-17T01:00:03.308814Z"} 2026-09-17T01:00:03.308814+00:00 https://vulnerability.circl.lu/sighting/3cd4bad2-9718-46b8-bf42-1ad5afc0f0f7/export 2026-09-17T23:15:13.261740+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "3cd4bad2-9718-46b8-bf42-1ad5afc0f0f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102506", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-89026\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cflowsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-16 17:36:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIssabel pbxapi hard coded JWT RCE POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-17T01:00:03.191327Z"} 2026-09-17T01:00:03.191327+00:00 https://vulnerability.circl.lu/sighting/f0591b5c-9980-4ae3-bfe6-87fa06412304/export 2026-09-17T23:15:13.261841+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "f0591b5c-9980-4ae3-bfe6-87fa06412304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvogjws5uw2q", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): actively exploited flaw in Issabel Framework (open-source PBX) allows unauthenticated remote OS command execution via a hard-coded vuln. Patch ASAP.\nhttps://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-17T00:47:12.391540Z"} 2026-09-17T00:47:12.391540+00:00 https://vulnerability.circl.lu/sighting/33ec2aa7-f4d4-45d9-8ac4-222fe71fe6a4/export 2026-09-17T23:15:13.261935+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "33ec2aa7-f4d4-45d9-8ac4-222fe71fe6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/117283163293011954", "content": "\u203c\ufe0f Attackers are exploiting a critical Issabel Framework flaw.\nCVE-2026-89026 uses a hard-coded JWT signing key, letting unauthenticated remote attackers forge tokens and execute OS commands as the Asterisk user. A fix is available.\nHow the flaw works: https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T22:50:49.616282Z"} 2026-09-16T22:50:49.616282+00:00 https://vulnerability.circl.lu/sighting/71e38b5b-90e2-4e80-b442-6710b1ab5426/export 2026-09-17T23:15:13.262028+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "71e38b5b-90e2-4e80-b442-6710b1ab5426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102506", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-89026\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cflowsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0 | \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-16 17:36:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIssabel pbxapi hard coded JWT RCE POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-16T22:00:05.445982Z"} 2026-09-16T22:00:05.445982+00:00 https://vulnerability.circl.lu/sighting/247c7c2b-0a85-4cf9-9f6e-96a98a4d6960/export 2026-09-17T23:15:13.262122+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "247c7c2b-0a85-4cf9-9f6e-96a98a4d6960", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvntuuhfbi22", "content": "Patch Issabel Framework now \u2014 CVE-2026-89026 (CVSS 9.8): hard-coded key lets attackers forge admin tokens and run OS commands as root, exploited since 9 Sept. https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T19:13:17.867344Z"} 2026-09-16T19:13:17.867344+00:00