NewsThe Hacker News2026-09-16 15:50 UTC

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded

CVE-2026-89026Sicherheitsluecke -- CVE-2026-89026
CVE-2026-89026Das Issabel Framework, das Web-Framework, das die Issabel PBX-Software unterstützt, enthält vor dem Commit b97dbaf eine hartkodierte HS256 JWT-Signaturschlüssel in der Datei pbxapi index.

Other advisories

osv:CVE-2026-107657none
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
osv:CVE-2026-103482none
Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
osv:CVE-2026-93775none
Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
osv:CVE-2026-92975none
Groundhogg <= 4.8.3 - Unauthenticated Privilege Escalation to Support User Identity Confusion
osv:CVE-2026-104899none
GeoDirectory <= 2.8.187 - Unauthenticated Local File Inclusion via 'design_type' Parameter
osv:CVE-2026-96667none
Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
osv:CVE-2026-89301none
rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter
CVE-2026-107805none
Nginx UI: Unauthenticated signed-request body staging can exhaust temporary storage

Other news entries

Newscsoonline2026-10-09
Exposed Nvidia GPU monitors can reveal AI infrastructure secrets
Newsthehackernews2026-10-07
Unpatched Critical LMCache Flaw Lets Unauthenticated Attackers Run Code Remotely
Newssecurityweek2026-10-07
Atlassian Patches Critical Vulnerability Affecting 8 Products
Newsthehackernews2026-10-06
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
Newsthehackernews2026-10-02
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Newsthehackernews2026-10-02
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes
Newssecurityweek2026-10-01
Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability
Newsfortinet-psirt2026-10-01
Improper limitation of a pathname to a restricted directory

Source: https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html

Linked advisories

More on Unauthenticated