ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Shadowserver”

3 items in the last 24h

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 3
SeverityAllcritical 2high 1medium 0low 0info 0

Critical ScreenConnect flaw now actively exploited in attacks

CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.

ConnectWise's ScreenConnect flaw CVE-2026-84869, an improper privilege management and missing authorization bug, lets attackers with basic privileges transfer or execute files through active remote sessions in low-complexity attacks without user interaction. It is patched in ScreenConnect 26.6.5; CISA added it to the KEV catalog and ordered US federal agencies to secure systems within three days. Shadowserver tracks over 1,000 unpatched exposed instances, mostly in North America (758) and Europe (180). This is the fourth actively exploited ScreenConnect flaw since 2024; earlier issues were abused by Kimsuky and ransomware gangs.

BleepingComputerupdated · 14h agofirst · 18h agoExploit / PoC in the wild 4 sourcesCVE-2026-84869CVE-2024-1709CVE-2025-3935+1 CVEs1

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.

VulnCheck reported active exploitation of CVE-2026-89026 (CVSS v3.1 9.8) in Issabel Framework, the web framework for the open-source Issabel unified communications PBX. A hard-coded HS256 JWT signing key identical across every installation lets unauthenticated attackers forge bearer tokens and abuse the /pbxapi/manager/originate endpoint, causing Asterisk to execute arbitrary OS commands as the Asterisk user. A patch replacing the hard-coded key with one stored in /etc/issabel.conf shipped August 1, 2026, and the Shadowserver Foundation first observed exploitation on September 9, 2026. Details on real-world abuse, attribution, and scale remain unknown.

The Hacker News · 13h agoExploit / PoC in the wild 2 sourcesCVE-2026-89026

Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild

Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.

CVE-2026-89026 (CVSS v4 9.3) stems from a hard-coded HS256 JWT signing key in Issabel Framework's pbxapi/index.php, letting unauthenticated attackers forge bearer tokens and execute OS commands through the Asterisk Manager Interface originate endpoint. Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected. Shadowserver Foundation first observed exploitation on September 9, 2026, and VulnCheck added the flaw to its Known Exploited Vulnerabilities database.

Cyber Security Newsupdated · 13h agofirst · 16h agoExploit / PoC in the wild 2 sourcesCVE-2026-890261