{"vulnerability": "cve-2026-8902", "sightings": [{"uuid": "53299747-449e-43a7-afb1-a4af65973b0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8902", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mntmuwjlr62h", "content": "CVE-2026-8902 - AJAX Report Comments\nCVE ID : CVE-2026-8902\n \n Published : June 9, 2026, 5:16 a.m. | 1\u00a0hour, 18\u00a0minutes ago\n \n Description : The AJAX Report Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.4. T...", "creation_timestamp": "2026-06-09T07:02:29.131748Z"}, {"uuid": "8f34d19d-3b09-496b-8030-5dd6a2c4d843", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-8902", "type": "seen", "source": "https://bsky.app/profile/atomicedge.bsky.social/post/3mnzmqqeu5s2h", "content": "CVE-2026-8902 report-comments (CVSS Score 4.3) \n\n#WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge #cybersecurity #malware #vulnerabilityresearch #cve #redteam #proofofconcept #report-comments", "creation_timestamp": "2026-06-11T16:16:06.840505Z"}, {"uuid": "212591db-4ad8-416c-85e6-e4e4968eb21b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89023", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvivllr7222r", "content": "\ud83d\udfe0 CVE-2026-89023 - High (8.6)\n\nThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization v...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-89023/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-14T20:00:36.691703Z"}, {"uuid": "478f4d01-a6b0-4862-a2d6-572d21f1cbb2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89023", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/5omofnt64v5up", "content": "CVE-2026-89023 - ThemeAtelier Domain For Sale\nCVE ID : CVE-2026-89023\n \n Published : Sept. 14, 2026, 7:17 p.m. | 42\u00a0minutes ago\n \n Description : ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoi...", "creation_timestamp": "2026-09-14T20:44:51.550961Z"}, {"uuid": "b8e55587-679c-4be4-91cc-f39223fda282", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89025", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvkyofw5es2b", "content": "\ud83d\udfe0 CVE-2026-89025 - High (7.5)\n\nHirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrat...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-89025/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-15T16:01:15.045151Z"}, {"uuid": "03874ce7-60b2-4374-afc9-ddcc37de528d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89022", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvl7spsncu2g", "content": "\ud83d\udea8 CVE-2026-89022 \u2014 CVSS 9.1 CRITICAL\n\nBookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89022\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T18:08:52.273256Z"}, {"uuid": "e741a3a1-33e6-4067-a00c-5cccf72334dd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvl7sxnjy62j", "content": "\ud83d\udea8 CVE-2026-89026 \u2014 CVSS 9.3 CRITICAL\n\nThe Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89026\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-15T18:08:59.695095Z"}, {"uuid": "f8799d0e-22d6-4bcb-93ef-7d6fe3473cdd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvlagwcy572w", "content": "CVE-2026-89026 - issabel framework\nThe Issabel Framework that powers Issabel PBX includes a built-in secret that is the same on every installation. Because the secret is identical, anyone\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#issabelframework #issabelfoundation #CVE #infosec", "creation_timestamp": "2026-09-15T18:20:09.391633Z"}, {"uuid": "c662397d-d87f-49fb-b6a9-974ff58acdc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89022", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvlc4i3dql2w", "content": "CVE-2026-89022 - bookstack\nBookStack versions before 26.05.5 let anyone use a social login to log in as any existing user without a password. The flaw occurs because the system does not check which\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#bookstack #bookstackapp #CVE #infosec", "creation_timestamp": "2026-09-15T18:50:06.854229Z"}, {"uuid": "8657b274-a672-4a3f-afd8-16647bdfca88", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/thedailytechfeed.com/post/3mvn7wjfsa32b", "content": "A hard-coded JWT key in Issabel PBX (CVE-2026-89026) enables unauthenticated OS command execution\u2014urgent patch needed. #SecurityNews #PBX #CVE2026 #JWT #Issabel #Vulnerability #Cybersecurity thedailytechfeed.com/critical-cve...", "creation_timestamp": "2026-09-16T13:16:18.870159Z"}, {"uuid": "980cc544-c1e8-4b44-b60b-082dd67e3fca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newsfacts.bsky.social/post/3mvnadwwqzs26", "content": "Kritieke kwetsbaarheid in Issabel Framework opent deuren voor systeemovername\n\nEen kritieke beveiligingskwetsbaarheid, met de identificatiecode CVE-2026-89026, is ontdekt in het Issabel Framework, dat gebruikt wordt voor Issabel PBX-implementaties. De kwetsbaarheid is door VulnCheck beoor...", "creation_timestamp": "2026-09-16T13:23:49.543484Z"}, {"uuid": "595f29de-e593-48f0-bef6-e7ff537aacb5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvnl7mcrrr2u", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): unauthenticated OS command execution in the Issabel Framework PBX, actively exploited. Hard-coded flaw lets remote attackers run arbitrary commands.\n\nhttps://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T16:38:14.924870Z"}, {"uuid": "3906ac8f-ee0e-4c1a-b7ba-29729ba35c9c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mvnkyg6knd22", "content": "CVE-2026-89026 enables unauthenticated remote command execution in Issabel Framework via a hard-coded JWT signing key.\n", "creation_timestamp": "2026-09-16T16:34:14.542227Z"}, {"uuid": "c9ebc3c9-431e-4bc6-9a27-4a181b1c22a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mvnlercf6y2c", "content": "Issabel Framework\u306e\u8106\u5f31\u6027(CVE-2026-89026)\u304c\u60aa\u7528\u3055\u308c\u3001\u8a8d\u8a3c\u306a\u3057\u3067OS\u30b3\u30de\u30f3\u30c9\u5b9f\u884c\u304c\u53ef\u80fd\u3002", "creation_timestamp": "2026-09-16T16:41:09.283466Z"}, {"uuid": "e98c19ca-79d7-4acf-89ea-d30113424000", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/c306c704-d4c2-42b1-9868-8974a4751715", "content": "", "creation_timestamp": "2026-09-16T17:00:34.422909Z"}, {"uuid": "7cb4ba6a-8909-45eb-9da3-2671d5505f94", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/deafnews-auto.bsky.social/post/3mvnmxyqcgm2h", "content": "CVE-2026-89026: Hard-Coded JWT Key Enables RCE on Issabel PBX", "creation_timestamp": "2026-09-16T17:09:47.962502Z"}, {"uuid": "1bb343fd-33a9-44e3-bdbb-d0fe77adaec5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "exploited", "source": "https://t.me/thehackernews/10077", "content": "\u203c\ufe0f Attackers are exploiting a critical Issabel Framework flaw.\n\nCVE-2026-89026 uses a hard-coded JWT signing key, letting unauthenticated remote attackers forge tokens and execute OS commands as the Asterisk user. A fix is available.\n\nHow the flaw works: https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T19:00:04.999905Z"}, {"uuid": "9682707f-7447-436c-9ccb-aa5b44a1e151", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "content": "A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation.\n\nThe vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded", "creation_timestamp": "2026-09-16T19:00:42.673154Z"}, {"uuid": "cb05098f-095f-438d-9d43-e27953565f09", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://infosec.exchange/users/cloud/statuses/117281697626464498", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): unauthenticated OS command execution in the Issabel Framework PBX, now under active exploitation. Hard-coded flaw lets remote attackers run arbitrary commands \u2014 patch immediately.\n\ud83d\udd17 https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html#CVE #RCE #CyberSec", "creation_timestamp": "2026-09-16T19:06:40.401180Z"}, {"uuid": "247c7c2b-0a85-4cf9-9f6e-96a98a4d6960", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mvntuuhfbi22", "content": "Patch Issabel Framework now \u2014 CVE-2026-89026 (CVSS 9.8): hard-coded key lets attackers forge admin tokens and run OS commands as root, exploited since 9 Sept. https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T19:13:17.867344Z"}, {"uuid": "71e38b5b-90e2-4e80-b442-6710b1ab5426", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102506", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-89026\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a cflowsec\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-16 17:36:26\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nIssabel pbxapi hard coded JWT RCE POC\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-16T22:00:05.445982Z"}, {"uuid": "33ec2aa7-f4d4-45d9-8ac4-222fe71fe6a4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://infosec.exchange/users/tomcat/statuses/117283163293011954", "content": "\u203c\ufe0f Attackers are exploiting a critical Issabel Framework flaw.\nCVE-2026-89026 uses a hard-coded JWT signing key, letting unauthenticated remote attackers forge tokens and execute OS commands as the Asterisk user. A fix is available.\nHow the flaw works: https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-16T22:50:49.616282Z"}, {"uuid": "f0591b5c-9980-4ae3-bfe6-87fa06412304", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvogjws5uw2q", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): actively exploited flaw in Issabel Framework (open-source PBX) allows unauthenticated remote OS command execution via a hard-coded vuln. Patch ASAP.\nhttps://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-17T00:47:12.391540Z"}, {"uuid": "c627b381-3c3b-4265-a524-891cd0301a05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mvoqim3lhm27", "content": "Critical Issabel Framework flaw CVE-2026-89026 (CVSS 9.8) is being exploited to forge JWT tokens and run OS commands without authentication. Patch released Aug 1, 2026. #Issabel #CVE-2026-89026 #Shadowserver", "creation_timestamp": "2026-09-17T03:45:25.765336Z"}, {"uuid": "667b5e32-8dba-4abd-9faf-73f9bd3b8049", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvpinowfvw2u", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.8): unauthenticated RCE in Issabel Framework PBX via hard-coded credentials, actively exploited in the wild. Patch now.\n\nhttps://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html", "creation_timestamp": "2026-09-17T10:57:45.590312Z"}, {"uuid": "6f98727f-bb43-4238-b80e-02011b249a60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3mvppnbja452r", "content": "Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution (CVE-2026-89026) #appsec", "creation_timestamp": "2026-09-17T13:02:47.465917Z"}, {"uuid": "a5a2a84f-3368-4df1-a9da-7f35afd7eefe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "Telegram/c5SreYmrDkdJR1r3a8RFt1SI3OPNA8AQ129hesIQxK_5L6E", "content": "", "creation_timestamp": "2026-09-18T04:00:08.691817Z"}, {"uuid": "450191aa-ff1c-4547-942b-10bba75b8c18", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "Telegram/YI-zyM6R2SXtebw0qilHuE_bC29iP0vy8Cn8zxh5ugjaAgA", "content": "", "creation_timestamp": "2026-09-18T04:00:09.437131Z"}, {"uuid": "8c222d56-9078-49e8-9ca3-9e43f99f68c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "published-proof-of-concept", "source": "Telegram/YI-zyM6R2SXtebw0qilHuE_bC29iP0vy8Cn8zxh5ugjaAgA", "content": "", "creation_timestamp": "2026-09-19T00:00:24.195979Z"}, {"uuid": "bc8e45df-a529-4830-ab32-3cb7e152246a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "published-proof-of-concept", "source": "Telegram/c5SreYmrDkdJR1r3a8RFt1SI3OPNA8AQ129hesIQxK_5L6E", "content": "", "creation_timestamp": "2026-09-19T00:00:25.285069Z"}, {"uuid": "8c1cb073-a06f-4a51-837b-0fda53fd2149", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://t.me/sec_post/1492", "content": "\u2757\ufe0f\u0412\u0435\u0431-\u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a Issabel \u0430\u0442\u0430\u043a\u0443\u044e\u0442 \u0447\u0435\u0440\u0435\u0437 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0441 9,8 \u0431\u0430\u043b\u043b\u0430\u043c\u0438 CVSS \u2014 \u044d\u0442\u043e \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0443 \u0440\u043e\u0441\u0441\u0438\u0439\u0441\u043a\u0438\u0445 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0442\u043e\u0440\u043e\u0432\n\n\ud83d\udcbb \u0412 Issabel Framework \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0443\u044e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c CVE-2026-89026 \u0441 \u043e\u0446\u0435\u043d\u043a\u043e\u0439 9.8 \u043f\u043e CVSS: \u043e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c\u0443 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u041e\u0421 \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 IP-\u0410\u0422\u0421. \u041f\u0430\u0442\u0447 \u0432\u044b\u0448\u0435\u043b 1 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 2026 \u0433\u043e\u0434\u0430, \u043d\u043e \u043f\u0435\u0440\u0432\u044b\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u0430\u043c\u0435\u0447\u0435\u043d\u044b 9 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f, \u0430 \u043c\u0430\u0441\u0448\u0442\u0430\u0431 \u0430\u0442\u0430\u043a \u043f\u043e\u043a\u0430 \u043d\u0435\u0438\u0437\u0432\u0435\u0441\u0442\u0435\u043d. \u0414\u043b\u044f \u0420\u043e\u0441\u0441\u0438\u0438 \u0443\u0433\u0440\u043e\u0437\u0430 \u043f\u0440\u044f\u043c\u0430\u044f: Issabel \u0430\u043a\u0442\u0438\u0432\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0442\u043e\u0440\u044b \u0434\u043b\u044f \u043f\u043e\u0441\u0442\u0440\u043e\u0435\u043d\u0438\u044f IP-\u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0438\u0438 \u043d\u0430 Asterisk, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0443 \u043d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u0438 \u0441\u0440\u0435\u0434\u043d\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432, \u0430 \u0442\u0430\u043a\u0438\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043d\u0435\u0440\u0435\u0434\u043a\u043e \u0441\u0442\u0430\u0432\u044f\u0442 \u0433\u043e\u0434\u044b \u043d\u0430\u0437\u0430\u0434 \u0438 \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u044f\u044e\u0442.\n\n\u042d\u043a\u0441\u043f\u0435\u0440\u0442\u044b \u043e\u0442\u043c\u0435\u0447\u0430\u044e\u0442, \u0447\u0442\u043e \u0440\u0438\u0441\u043a \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u0432\u044b\u0441\u043e\u043a, \u0435\u0441\u043b\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0441\u0435\u0440\u0432\u0435\u0440 \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442\u0430: \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0435\u043c\u0443 \u0444\u0430\u043a\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u043d\u0435 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0443\u0447\u0451\u0442\u043d\u0430\u044f \u0437\u0430\u043f\u0438\u0441\u044c. \u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u043c\u043e\u0433\u0443\u0442 \u0432\u044b\u0439\u0442\u0438 \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u044b \u0442\u0435\u043b\u0435\u0444\u043e\u043d\u0438\u0438 \u2014 \u043e\u0442 \u043a\u0440\u0430\u0436\u0438 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0440\u0430\u0437\u0433\u043e\u0432\u043e\u0440\u043e\u0432 \u0438 SIP-\u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 \u0434\u043e \u0440\u0430\u0437\u0432\u0438\u0442\u0438\u044f \u0430\u0442\u0430\u043a\u0438 \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443.\n\n\u041f\u043e\u0434\u0440\u043e\u0431\u043d\u0435\u0435 \u2014 \u0432 \u043c\u0430\u0442\u0435\u0440\u0438\u0430\u043b\u0435 SecPost\ud83d\ude0d\n\n\u2014 \n\u041f\u043e\u0434\u0430\u0442\u044c \u0437\u0430\u044f\u0432\u043a\u0443 \u0432 \u0440\u0435\u0439\u0442\u0438\u043d\u0433 \u00ab\u041d\u043e\u0432\u0430\u044f \u044d\u043b\u0438\u0442\u0430 \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u0430\u00bb", "creation_timestamp": "2026-09-21T07:04:24.727946Z"}, {"uuid": "34130b2d-c2cd-4767-ab9f-7eea9db77cbc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "exploited", "source": "https://t.me/CyberDispatch/2973", "content": "Attackers are exploiting a critical Issabel Framework flaw.\n\nCVE-2026-89026 uses a hard-coded JWT signing key, letting unauthenticated remote attackers forge tokens and execute OS commands as the Asterisk user. A fix is available.", "creation_timestamp": "2026-09-21T13:00:04.588588Z"}, {"uuid": "256e13cf-cdfd-4e5f-856a-735a2cd5b532", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mvzwalmlq32w", "content": "\ud83e\udd16 CVE-2026-89026 (CVSS 9.3): hard-coded JWT key in Issabel PBX -> unauthenticated token forgery, RCE as Asterisk user. Exploited in the wild (Shadowserver). PoC published.\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-89026", "creation_timestamp": "2026-09-21T14:27:36.046350Z"}, {"uuid": "fcc7e655-f7e7-47d4-bb66-46c32f6836e3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/102952", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-89026\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a AranFarzami\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-09-21 10:59:52\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC exploit and scanner for CVE-2026-89026, targeting the Issabel PBXAPI authentication vulnerability\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-09-21T15:00:03.799247Z"}, {"uuid": "799e1317-37c5-489d-9175-bfa3341e4b90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "seen", "source": "https://t.me/ViralCyber/26318", "content": "\ud83d\udd34\u06a9\u0634\u0641 \u0622\u0633\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 Issabel\u061b \u062d\u0645\u0644\u0627\u062a \u0641\u0639\u0627\u0644 \u0648 \u0627\u062c\u0631\u0627\u06cc Command \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 Login!\n\ud83d\udca2\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 Issabel Framework \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-89026 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0648\u0627\u0642\u0639\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a. \u0634\u062f\u062a \u0627\u06cc\u0646 \u0646\u0642\u0635 \u062f\u0631 CVSS v3.1 \u0628\u0631\u0627\u0628\u0631 9.8 \u0627\u0639\u0644\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\ud83d\udca2\u0627\u06cc\u0632\u0627\u0628\u0644 \u0627\u0632 \u06cc\u06a9 JWT Signing Key \u062b\u0627\u0628\u062a \u0648 Hard-coded \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u06a9\u0647 \u0627\u06cc\u0646 \u06a9\u0644\u06cc\u062f \u0644\u0648 \u0631\u0641\u062a\u0647\u061b \u06a9\u0644\u06cc\u062f\u06cc \u06a9\u0647 \u062f\u0631 \u0646\u0633\u062e\u0647 \u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u06cc\u06a9\u0633\u0627\u0646 \u0627\u0633\u062a. \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u062f\u0627\u0634\u062a\u0646 Username \u0648 Password\u060c \u06cc\u06a9 JWT \u0645\u0639\u062a\u0628\u0631 \u062c\u0639\u0644 \u06a9\u0631\u062f\u0647 \u0648 \u0627\u0632 API \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 PBX \u0639\u0628\u0648\u0631 \u06a9\u0646\u062f.\n\ud83d\udca2\u062f\u0631 \u0645\u0631\u062d\u0644\u0647 \u0628\u0639\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 endpoint \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Asterisk Manager Originate \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0648 \u062f\u0631 \u0646\u0647\u0627\u06cc\u062a \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 \u0631\u0627 \u0628\u0627 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u06a9\u0627\u0631\u0628\u0631 Asterisk \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f. \u0645\u0647\u0627\u062c\u0645 \u0646\u0647 \u062a\u0646\u0647\u0627 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f Authentication Bypass \u06a9\u0646\u062f \u0628\u0644\u06a9\u0647 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f Remote Command Execution \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u062f.\n\ud83d\udca2\u0634\u0631\u06a9\u062a Shadowserver \u0627\u0632 \u06f9 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f6 \u0646\u0645\u0648\u0646\u0647 \u0647\u0627\u06cc exploitation \u0648\u0627\u0642\u0639\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \u062c\u0632\u0626\u06cc\u0627\u062a \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0648 \u06af\u0633\u062a\u0631\u062f\u06af\u06cc \u062d\u0645\u0644\u0627\u062a \u0647\u0646\u0648\u0632 \u0645\u0634\u062e\u0635 \u0646\u06cc\u0633\u062a.\n\ud83d\udca2\u0627\u06cc\u0632\u0627\u0628\u0644 Patch \u0627\u06cc\u0646 \u0645\u0634\u06a9\u0644 \u0631\u0627 \u0627\u0632 \u06f1 \u0622\u06af\u0648\u0633\u062a \u06f2\u06f0\u06f2\u06f6 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\ud83d\udca2\u0627\u06af\u0631 Issabel PBX \u0634\u0645\u0627 \u0627\u0632 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0642\u0627\u0628\u0644 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0633\u062a\u060c \u0644\u0627\u0632\u0645 \u0627\u0633\u062a \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a Patch \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u06cc\u062f \u0648 Log\u0647\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u0631\u0648\u06cc PBX API \u0648 Asterisk \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f. (\u0645\u0646\u0628\u0639)\n\ud83d\udd34\u06af\u0641\u062a\u0646\u06cc \u0627\u0633\u062a #\u0627\u06cc\u0632\u0627\u0628\u0644 \u0628\u0647 \u0648\u0641\u0648\u0631 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc VoIP \u0633\u0627\u0632\u0645\u0627\u0646\u0647\u0627 \u0648 \u0634\u0631\u06a9\u062a \u0647\u0627 \u062f\u0631 \u0627\u06cc\u0631\u0627\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u0634\u0648\u062f. \u0646\u0641\u0648\u0630 \u0645\u0648\u0641\u0642 \u0628\u0647 Issabel \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0634\u0646\u0648\u062f \u0645\u06a9\u0627\u0644\u0645\u0627\u062a \u062a\u0644\u0641\u0646\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u060c \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062e\u0637\u0648\u0637 \u062a\u0644\u0641\u0646\u06cc\u060c \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u062a\u0646\u0638\u06cc\u0645\u0627\u062a PBX\u060c \u0627\u06cc\u062c\u0627\u062f \u062a\u0645\u0627\u0633\u200c\u0647\u0627\u06cc \u067e\u0631\u0647\u0632\u06cc\u0646\u0647\u060c \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0627\u062e\u0644\u06cc \u0648 \u062d\u062a\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0633\u0631\u0648\u0631 \u062a\u0644\u0641\u0646\u06cc \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0646\u0642\u0637\u0647 \u0648\u0631\u0648\u062f \u0628\u0647 \u0634\u0628\u06a9\u0647 \u0633\u0627\u0632\u0645\u0627\u0646 \u0645\u0646\u062c\u0631 \u0634\u0648\u062f.\n#Issabel #PBX #Asterisk #Vulnerability #CVE_2026_89026 #CyberSecurity\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "creation_timestamp": "2026-09-21T20:00:03.777396Z"}, {"uuid": "eb10480f-a2c4-4671-9a71-e2470178b211", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "exploited", "source": "https://t.me/ViralCyber/26318", "content": "\ud83d\udd34\u06a9\u0634\u0641 \u0622\u0633\u0628 \u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 Issabel\u061b \u062d\u0645\u0644\u0627\u062a \u0641\u0639\u0627\u0644 \u0648 \u0627\u062c\u0631\u0627\u06cc Command \u0628\u062f\u0648\u0646 \u0646\u06cc\u0627\u0632 \u0628\u0647 Login!\n\ud83d\udca2\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u062d\u0631\u0627\u0646\u06cc \u062f\u0631 Issabel Framework \u0628\u0627 \u0634\u0646\u0627\u0633\u0647 CVE-2026-89026 \u062f\u0631 \u062d\u0645\u0644\u0627\u062a \u0648\u0627\u0642\u0639\u06cc \u0645\u0648\u0631\u062f \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0642\u0631\u0627\u0631 \u06af\u0631\u0641\u062a\u0647 \u0627\u0633\u062a. \u0634\u062f\u062a \u0627\u06cc\u0646 \u0646\u0642\u0635 \u062f\u0631 CVSS v3.1 \u0628\u0631\u0627\u0628\u0631 9.8 \u0627\u0639\u0644\u0627\u0645 \u0634\u062f\u0647 \u0627\u0633\u062a.\n\ud83d\udca2\u0627\u06cc\u0632\u0627\u0628\u0644 \u0627\u0632 \u06cc\u06a9 JWT Signing Key \u062b\u0627\u0628\u062a \u0648 Hard-coded \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u06a9\u0647 \u0627\u06cc\u0646 \u06a9\u0644\u06cc\u062f \u0644\u0648 \u0631\u0641\u062a\u0647\u061b \u06a9\u0644\u06cc\u062f\u06cc \u06a9\u0647 \u062f\u0631 \u0646\u0633\u062e\u0647 \u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631 \u06cc\u06a9\u0633\u0627\u0646 \u0627\u0633\u062a. \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u062f\u0648\u0646 \u062f\u0627\u0634\u062a\u0646 Username \u0648 Password\u060c \u06cc\u06a9 JWT \u0645\u0639\u062a\u0628\u0631 \u062c\u0639\u0644 \u06a9\u0631\u062f\u0647 \u0648 \u0627\u0632 API \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 PBX \u0639\u0628\u0648\u0631 \u06a9\u0646\u062f.\n\ud83d\udca2\u062f\u0631 \u0645\u0631\u062d\u0644\u0647 \u0628\u0639\u062f\u060c \u0645\u0647\u0627\u062c\u0645 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0627\u0632 endpoint \u0645\u0631\u0628\u0648\u0637 \u0628\u0647 Asterisk Manager Originate \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0648 \u062f\u0631 \u0646\u0647\u0627\u06cc\u062a \u062f\u0633\u062a\u0648\u0631\u0627\u062a \u0633\u06cc\u0633\u062a\u0645\u200c\u0639\u0627\u0645\u0644 \u0631\u0627 \u0628\u0627 \u0633\u0637\u062d \u062f\u0633\u062a\u0631\u0633\u06cc \u06a9\u0627\u0631\u0628\u0631 Asterisk \u0627\u062c\u0631\u0627 \u06a9\u0646\u062f. \u0645\u0647\u0627\u062c\u0645 \u0646\u0647 \u062a\u0646\u0647\u0627 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f Authentication Bypass \u06a9\u0646\u062f \u0628\u0644\u06a9\u0647 \u0645\u06cc \u062a\u0648\u0627\u0646\u062f Remote Command Execution \u0627\u0646\u062c\u0627\u0645 \u062f\u0647\u062f.\n\ud83d\udca2\u0634\u0631\u06a9\u062a Shadowserver \u0627\u0632 \u06f9 \u0633\u067e\u062a\u0627\u0645\u0628\u0631 \u06f2\u06f0\u06f2\u06f6 \u0646\u0645\u0648\u0646\u0647 \u0647\u0627\u06cc exploitation \u0648\u0627\u0642\u0639\u06cc \u0627\u06cc\u0646 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0631\u0627 \u0645\u0634\u0627\u0647\u062f\u0647 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a. \u062c\u0632\u0626\u06cc\u0627\u062a \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0648 \u06af\u0633\u062a\u0631\u062f\u06af\u06cc \u062d\u0645\u0644\u0627\u062a \u0647\u0646\u0648\u0632 \u0645\u0634\u062e\u0635 \u0646\u06cc\u0633\u062a.\n\ud83d\udca2\u0627\u06cc\u0632\u0627\u0628\u0644 Patch \u0627\u06cc\u0646 \u0645\u0634\u06a9\u0644 \u0631\u0627 \u0627\u0632 \u06f1 \u0622\u06af\u0648\u0633\u062a \u06f2\u06f0\u06f2\u06f6 \u0645\u0646\u062a\u0634\u0631 \u06a9\u0631\u062f\u0647 \u0627\u0633\u062a.\n\ud83d\udca2\u0627\u06af\u0631 Issabel PBX \u0634\u0645\u0627 \u0627\u0632 \u0627\u06cc\u0646\u062a\u0631\u0646\u062a \u0642\u0627\u0628\u0644 \u062f\u0633\u062a\u0631\u0633\u06cc \u0627\u0633\u062a\u060c \u0644\u0627\u0632\u0645 \u0627\u0633\u062a \u062f\u0631 \u0627\u0633\u0631\u0639 \u0648\u0642\u062a Patch \u0631\u0627 \u0646\u0635\u0628 \u06a9\u0646\u06cc\u062f \u0648 Log\u0647\u0627 \u0631\u0627 \u0628\u0631\u0627\u06cc \u0641\u0639\u0627\u0644\u06cc\u062a\u200c\u0647\u0627\u06cc \u063a\u06cc\u0631\u0639\u0627\u062f\u06cc \u0631\u0648\u06cc PBX API \u0648 Asterisk \u0628\u0631\u0631\u0633\u06cc \u06a9\u0646\u06cc\u062f. (\u0645\u0646\u0628\u0639)\n\ud83d\udd34\u06af\u0641\u062a\u0646\u06cc \u0627\u0633\u062a #\u0627\u06cc\u0632\u0627\u0628\u0644 \u0628\u0647 \u0648\u0641\u0648\u0631 \u062f\u0631 \u0633\u06cc\u0633\u062a\u0645 \u0647\u0627\u06cc VoIP \u0633\u0627\u0632\u0645\u0627\u0646\u0647\u0627 \u0648 \u0634\u0631\u06a9\u062a \u0647\u0627 \u062f\u0631 \u0627\u06cc\u0631\u0627\u0646 \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0645\u06cc \u0634\u0648\u062f. \u0646\u0641\u0648\u0630 \u0645\u0648\u0641\u0642 \u0628\u0647 Issabel \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0634\u0646\u0648\u062f \u0645\u06a9\u0627\u0644\u0645\u0627\u062a \u062a\u0644\u0641\u0646\u06cc \u0633\u0627\u0632\u0645\u0627\u0646\u060c \u0633\u0648\u0621\u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u062e\u0637\u0648\u0637 \u062a\u0644\u0641\u0646\u06cc\u060c \u062f\u0633\u062a\u06a9\u0627\u0631\u06cc \u062a\u0646\u0638\u06cc\u0645\u0627\u062a PBX\u060c \u0627\u06cc\u062c\u0627\u062f \u062a\u0645\u0627\u0633\u200c\u0647\u0627\u06cc \u067e\u0631\u0647\u0632\u06cc\u0646\u0647\u060c \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u062f\u0627\u062e\u0644\u06cc \u0648 \u062d\u062a\u06cc \u0627\u0633\u062a\u0641\u0627\u062f\u0647 \u0627\u0632 \u0633\u0631\u0648\u0631 \u062a\u0644\u0641\u0646\u06cc \u0628\u0647\u200c\u0639\u0646\u0648\u0627\u0646 \u0646\u0642\u0637\u0647 \u0648\u0631\u0648\u062f \u0628\u0647 \u0634\u0628\u06a9\u0647 \u0633\u0627\u0632\u0645\u0627\u0646 \u0645\u0646\u062c\u0631 \u0634\u0648\u062f.\n#Issabel #PBX #Asterisk #Vulnerability #CVE_2026_89026 #CyberSecurity\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "creation_timestamp": "2026-09-22T00:00:09.310920Z"}, {"uuid": "fd269dcd-1230-413a-a019-d5aa13f393bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89026", "type": "published-proof-of-concept", "source": "Telegram/N-PGdqpLovLlQNbFQgrQqO8zEkhxsB1txl4jHkkqUA3cCi4", "content": "", "creation_timestamp": "2026-09-22T07:00:03.888848Z"}]}