{"vulnerability": "CVE-2026-89026", "sightings": [{"uuid": "e741a3a1-33e6-4067-a00c-5cccf72334dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvl7sxnjy62j", "content": "\ud83d\udea8 CVE-2026-89026 \u2014 CVSS 9.3 CRITICAL\n\nThe Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89026\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T18:08:59.695095Z"}, {"uuid": "f8799d0e-22d6-4bcb-93ef-7d6fe3473cdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvlagwcy572w", "content": "CVE-2026-89026 - issabel framework\nThe Issabel Framework that powers Issabel PBX includes a built-in secret that is the same on every installation. Because the secret is identical, anyone\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#issabelframework #issabelfoundation #CVE #infosec", "creation_timestamp": "2026-09-15T18:20:09.391633Z"}, {"uuid": "8657b274-a672-4a3f-afd8-16647bdfca88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mvn7wjfsa32b", "content": "A hard-coded JWT key in Issabel PBX (CVE-2026-89026) enables unauthenticated OS command execution\u2014urgent patch needed. #SecurityNews #PBX #CVE2026 #JWT #Issabel #Vulnerability #Cybersecurity thedailytechfeed.com/critical-cve...", "creation_timestamp": "2026-09-16T13:16:18.870159Z"}, {"uuid": "980cc544-c1e8-4b44-b60b-082dd67e3fca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mvnadwwqzs26", "content": "Kritieke kwetsbaarheid in Issabel Framework opent deuren voor systeemovername\n\nEen kritieke beveiligingskwetsbaarheid, met de identificatiecode CVE-2026-89026, is ontdekt in het Issabel Framework, dat gebruikt wordt voor Issabel PBX-implementaties. De kwetsbaarheid is door VulnCheck beoor...", "creation_timestamp": "2026-09-16T13:23:49.543484Z"}, {"uuid": "595f29de-e593-48f0-bef6-e7ff537aacb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvnl7mcrrr2u", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): unauthenticated OS command execution in the Issabel Framework PBX, actively exploited. Hard-coded flaw lets remote attackers run arbitrary commands.\n\nhttps://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T16:38:14.924870Z"}, {"uuid": "3906ac8f-ee0e-4c1a-b7ba-29729ba35c9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvnkyg6knd22", "content": "CVE-2026-89026 enables unauthenticated remote command execution in Issabel Framework via a hard-coded JWT signing key.\n", "creation_timestamp": "2026-09-16T16:34:14.542227Z"}, {"uuid": "c9ebc3c9-431e-4bc6-9a27-4a181b1c22a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvnlercf6y2c", "content": "Issabel Framework\u306e\u8106\u5f31\u6027(CVE-2026-89026)\u304c\u60aa\u7528\u3055\u308c\u3001\u8a8d\u8a3c\u306a\u3057\u3067OS\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3002", "creation_timestamp": "2026-09-16T16:41:09.283466Z"}, {"uuid": "e98c19ca-79d7-4acf-89ea-d30113424000", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c306c704-d4c2-42b1-9868-8974a4751715", "content": "", "creation_timestamp": "2026-09-16T17:00:34.422909Z"}, {"uuid": "7cb4ba6a-8909-45eb-9da3-2671d5505f94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mvnmxyqcgm2h", "content": "CVE-2026-89026: Hard-Coded JWT Key Enables RCE on Issabel PBX", "creation_timestamp": "2026-09-16T17:09:47.962502Z"}, {"uuid": "1bb343fd-33a9-44e3-bdbb-d0fe77adaec5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "exploited", "source": "https://t.me/thehackernews/10077", "content": "\u203c\ufe0f Attackers are exploiting a critical Issabel Framework flaw.\n\nCVE-2026-89026 uses a hard-coded JWT signing key, letting unauthenticated remote attackers forge tokens and execute OS commands as the Asterisk user. A fix is available.\n\nHow the flaw works: https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T19:00:04.999905Z"}, {"uuid": "9682707f-7447-436c-9ccb-aa5b44a1e151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "content": "A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation.\n\nThe vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded", "creation_timestamp": "2026-09-16T19:00:42.673154Z"}, {"uuid": "cb05098f-095f-438d-9d43-e27953565f09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://infosec.exchange/users/cloud/statuses/117281697626464498", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): unauthenticated OS command execution in the Issabel Framework PBX, now under active exploitation. Hard-coded flaw lets remote attackers run arbitrary commands \u2014 patch immediately.\n\ud83d\udd17 https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html#CVE #RCE #CyberSec", "creation_timestamp": "2026-09-16T19:06:40.401180Z"}, {"uuid": "247c7c2b-0a85-4cf9-9f6e-96a98a4d6960", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvntuuhfbi22", "content": "Patch Issabel Framework now \u2014 CVE-2026-89026 (CVSS 9.8): hard-coded key lets attackers forge admin tokens and run OS commands as root, exploited since 9 Sept. https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T19:13:17.867344Z"}, {"uuid": "71e38b5b-90e2-4e80-b442-6710b1ab5426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102506", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-89026\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cflowsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-16 17:36:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIssabel pbxapi hard coded JWT RCE POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-16T22:00:05.445982Z"}, {"uuid": "33ec2aa7-f4d4-45d9-8ac4-222fe71fe6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/117283163293011954", "content": "\u203c\ufe0f Attackers are exploiting a critical Issabel Framework flaw.\nCVE-2026-89026 uses a hard-coded JWT signing key, letting unauthenticated remote attackers forge tokens and execute OS commands as the Asterisk user. A fix is available.\nHow the flaw works: https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T22:50:49.616282Z"}, {"uuid": "f0591b5c-9980-4ae3-bfe6-87fa06412304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvogjws5uw2q", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): actively exploited flaw in Issabel Framework (open-source PBX) allows unauthenticated remote OS command execution via a hard-coded vuln. Patch ASAP.\nhttps://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-17T00:47:12.391540Z"}, {"uuid": "3cd4bad2-9718-46b8-bf42-1ad5afc0f0f7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102506", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-89026\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cflowsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-16 17:36:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIssabel pbxapi hard coded JWT RCE POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-17T01:00:03.191327Z"}, {"uuid": "97857edd-68fc-4a50-93bf-ab2031c8145b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "exploited", "source": "https://t.me/thehackernews/10077", "content": "\u203c\ufe0f Attackers are exploiting a critical Issabel Framework flaw.\n\nCVE-2026-89026 uses a hard-coded JWT signing key, letting unauthenticated remote attackers forge tokens and execute OS commands as the Asterisk user. A fix is available.\n\nHow the flaw works: https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-17T01:00:03.308814Z"}, {"uuid": "17da7a35-3744-4ec9-b20b-dc4db8a8876c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "content": "A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation.\n\nThe vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded", "creation_timestamp": "2026-09-17T01:00:40.188294Z"}, {"uuid": "c627b381-3c3b-4265-a524-891cd0301a05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvoqim3lhm27", "content": "Critical Issabel Framework flaw CVE-2026-89026 (CVSS 9.8) is being exploited to forge JWT tokens and run OS commands without authentication. Patch released Aug 1, 2026. #Issabel #CVE-2026-89026 #Shadowserver", "creation_timestamp": "2026-09-17T03:45:25.765336Z"}, {"uuid": "667b5e32-8dba-4abd-9faf-73f9bd3b8049", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvpinowfvw2u", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): unauthenticated RCE in Issabel Framework PBX via hard-coded credentials, actively exploited in the wild. Patch now.\n\nhttps://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-17T10:57:45.590312Z"}, {"uuid": "6f98727f-bb43-4238-b80e-02011b249a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mvppnbja452r", "content": "Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution (CVE-2026-89026) #appsec", "creation_timestamp": "2026-09-17T13:02:47.465917Z"}]}