[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

2 clusters · 5 sources · 19 days · First seen · Last updated

Critical software vulnerabilities and exploitation

Overview

Multiple critical security vulnerabilities in web-based software frameworks have been identified and actively exploited.

In the Issabel Framework, a vulnerability identified as CVE-2026-89026 allows unauthenticated remote attackers to execute arbitrary operating system commands. This flaw results from a hard-coded HS256 JSON Web Token (JWT) signing key. Although a patch was released in August 2026, exploitation was observed by the Shadowserver Foundation in September 2026.

Separately, the Rejetto HTTP File Server (HFS) was found to have a vulnerability, CVE-2026-61500, which enables remote code execution by allowing attackers to forge administrator session cookies. This flaw was discovered via AI-assisted research. Despite a July 2026 patch, active exploitation attempts have been detected following the release of a Python-based proof-of-concept exploit in late September.

Entities

VulnCheck · Rejetto · Horizon3.ai · Anthropic · Shadowserver Foundation

Timeline

  1. [TECHNOLOGY] 3 sources
    Rejetto HFS vulnerability exploited for remote code execution

    Attackers are exploiting a critical 9.3 CVSS vulnerability (CVE-2026-61500) in Rejetto HFS, discovered via Anthropic’s Mythos AI, to bypass authentication and achieve remote code execution.

  2. [TECHNOLOGY] 3 sources
    Issabel Framework vulnerability enables remote OS command execution

    Attackers are exploiting a critical vulnerability (CVE-2026-89026) in the Issabel Framework to execute remote OS commands via a hard-coded JWT signing key. A patch is available.

Sources

cybernoz.com · infoguerra.com.br · it-boltwise.de · securityaffairs.com · sempreupdate.com.br