# Critical software vulnerabilities and exploitation

> Live situation record from CLSTR: https://clstr.news/situations/critical-software-vulnerabilities-and-exploitation
> Updated: 2026-10-05T10:20:02.000Z. Sources: 5. Developments: 2.

Multiple critical security vulnerabilities in web-based software frameworks have been identified and actively exploited.

In the Issabel Framework, a vulnerability identified as CVE-2026-89026 allows unauthenticated remote attackers to execute arbitrary operating system commands. This flaw results from a hard-coded HS256 JSON Web Token (JWT) signing key. Although a patch was released in August 2026, exploitation was observed by the Shadowserver Foundation in September 2026.

Separately, the Rejetto HTTP File Server (HFS) was found to have a vulnerability, CVE-2026-61500, which enables remote code execution by allowing attackers to forge administrator session cookies. This flaw was discovered via AI-assisted research. Despite a July 2026 patch, active exploitation attempts have been detected following the release of a Python-based proof-of-concept exploit in late September.

## Timeline

### 2026-10-05: Rejetto HFS vulnerability exploited for remote code execution

Attackers are exploiting a critical 9.3 CVSS vulnerability (CVE-2026-61500) in Rejetto HFS, discovered via Anthropic’s Mythos AI, to bypass authentication and achieve remote code execution.

3 sources. https://clstr.news/cluster/rejetto-hfs-vulnerability-exploited-for-remote-code-execution

### 2026-09-16: Issabel Framework vulnerability enables remote OS command execution

Attackers are exploiting a critical vulnerability (CVE-2026-89026) in the Issabel Framework to execute remote OS commands via a hard-coded JWT signing key. A patch is available.

3 sources. https://clstr.news/cluster/issabel-framework-vulnerability-enables-remote-os-command-execution

---
Cite as: Critical software vulnerabilities and exploitation. CLSTR, https://clstr.news/situations/critical-software-vulnerabilities-and-exploitation