The Exploit Bulletin — Wednesday, September 16, 2026: 4 issues require action
Wednesday, September 16, 2026 — 4 issues require action. If you run none of the software below, you are done.
Affects: WSO2 API Manager · WSO2 Universal Gateway · WSO2 Traffic Manager · WSO2 API Control Plane · marimo-team marimo · Issabel Framework · IBM Db2 Mirror for i (web GUI WAR on IBM i Liberty)
1. JWT algorithm confusion lets unauthenticated attackers forge admin tokens in WSO2 API Manager (CVE-2026-5430)
AUTHENTICATION BYPASS · CRITICAL · CVSS 10.0
watchTowr reports active exploitation attempts using forged admin tokens, so an unpatched, internet-facing WSO2 gateway can be taken over without credentials by anyone replaying the technique.
The JWT authentication mechanism in WSO2 API Manager, Universal Gateway, Traffic Manager and API Control Plane accepts tokens signed with algorithms other than those configured, so an unauthenticated attacker can craft a token that passes validation. The result is unauthorized access up to administrative account takeover, with cross-tenant impact in multi-tenant deployments.
Affected: WSO2 API Manager 4.1.0 < 4.1.0.257; WSO2 API Manager 4.2.0 < 4.2.0.197; WSO2 API Manager 4.3.0 < 4.3.0.108; WSO2 API Manager 4.4.0 < 4.4.0.72; WSO2 Universal Gateway 4.5.0 < 4.5.0.57; WSO2 Universal Gateway 4.6.0 < 4.6.0.21; WSO2 Traffic Manager 4.5.0 < 4.5.0.56; WSO2 Traffic Manager 4.6.0 < 4.6.0.21; WSO2 API Control Plane 4.5.0 < 4.5.0.58; WSO2 API Control Plane 4.6.0 < 4.6.0.22
How to Test: Confirm the product and update level of every WSO2 API Manager, Universal Gateway, Traffic Manager and API Control Plane node against the fixed update levels above; anything below is vulnerable. Review gateway and key-manager authentication logs for accepted JWTs whose header algorithm differs from the configured signing algorithm, and audit recent administrative logins, new admin users, and API/application changes that no operator can account for.
How to Patch: Update to API Manager 4.1.0.257, 4.2.0.197, 4.3.0.108 or 4.4.0.72; Universal Gateway 4.5.0.57 or 4.6.0.21; Traffic Manager 4.5.0.56 or 4.6.0.21; API Control Plane 4.5.0.58 or 4.6.0.22, per WSO2 advisory WSO2-2026-5328. Until updated, restrict network access to the management and admin interfaces to trusted sources.
Evidence: The Hacker News: active exploitation attempts with forged admin tokens, per watchTowr · SecurityWeek: enterprises warned of attacks exploiting WSO2 vulnerability
2. Unauthenticated remote code execution in Marimo notebook server (CVE-2026-39987)
CISA KEV (due 2026-05-07) · REMOTE CODE EXECUTION · CRITICAL · CVSS 9.3
Sysdig, via The Hacker News on 2026-09-15, documented a fresh intrusion in which a human operator exploited this Marimo RCE and reached an SSH bastion within eight seconds, so any team still running a pre-0.23.0 Marimo instance reachable over the network should treat it as compromised-in-waiting.
Marimo versions before 0.23.0 expose a pre-authentication flaw that lets an unauthenticated remote attacker obtain shell access and run arbitrary system commands on the host serving the notebook. Twenty-one public exploits are catalogued in VulnCheck XDB.
Affected: marimo-team marimo < 0.23.0
How to Test: Check the installed marimo package version on every host that runs a notebook server; anything below 0.23.0 is vulnerable. Identify which marimo instances are reachable from outside the host (bound to a non-loopback interface or exposed through a proxy). On exposed instances, review process and shell history for unexpected commands spawned by the marimo server process, and — per the Sysdig-described attack chain — review SSH authentication logs on bastions and other hosts for logins originating from the notebook host.
How to Patch: Upgrade marimo to 0.23.0 or later on every host. Until upgraded, remove network exposure of the notebook server (bind to localhost only or restrict access to trusted addresses) — no other vendor mitigation is given in the dossier.
Evidence: CISA KEV · VulnCheck KEV · CISA SSVC: active · The Hacker News (2026-09-15): Sysdig-observed human attacker exploiting Marimo RCE, reaching SSH bastion in eight seconds · Unit 42 (2026-07-30): exploitation in autonomous AI-driven attack campaign · Proofpoint (2026-05-27): 2026 vulnerability exploitation in the wild
3. Hard-coded JWT signing key in Issabel PBX pbxapi allows unauthenticated OS command execution (CVE-2026-89026)
REMOTE CODE EXECUTION · CRITICAL · CVSS 9.3
VulnCheck added this to its KEV catalog yesterday citing Shadowserver observations of exploitation beginning 2026-09-09, and any Issabel PBX exposing pbxapi with the old key can be fully compromised by a single forged token.
The Issabel Framework's pbxapi/index.php shipped an HS256 JWT signing key identical on every installation, so any remote attacker can forge a valid bearer token. With that token, the manager originate endpoint can be called with the System application to make Asterisk run arbitrary OS commands as the asterisk user.
Affected: Issabel Framework before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd
How to Test: Open framework/html/pbxapi/index.php on the PBX: if JWT_KEY is set to the literal string da893kasdfam43k29akdkfaFFlsdfhj23rasdf rather than read from pbxapijwtsecret in /etc/issabel.conf, the system is vulnerable. Check web server logs for requests to the pbxapi manager originate endpoint from unknown sources, review Asterisk logs for originate calls using the System application, and inspect the asterisk user's processes, cron entries and home directory for unexpected files.
How to Patch: Update the Issabel Framework to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd or later, then add a pbxapijwtsecret entry to /etc/issabel.conf containing at least 32 random bytes encoded as Base64 (the patched code refuses to start without it). If updating must wait, block external access to the pbxapi path at the firewall or web server.
Evidence: VulnCheck KEV
4. Pre-auth RCE chain in IBM Db2 Mirror for i GUI reaches QSECOFR (IBM Db2 Mirror for i)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
A detailed, reproducible pre-auth chain against an administrative interface on IBM i is public with no CVE or vendor fix; exposed GUIs should be locked down before it is weaponized.
A researcher write-up shows an unauthenticated exploit chain in the IBM Db2 Mirror for i web interface. Adding a semicolon path parameter (e.g. /Db2MirrorServlet;x/...) makes the AuthFilter's rets[2].equals("Db2MirrorServlet") check miss the servlet while the container still routes the request, bypassing session, BuildTimeStamp and MN checks; a separate skipVald request parameter disables input validation without a login. From there action methods become reachable, leading to arbitrary Java/JSP execution in Liberty and, via a native helper, a local Db2 connection identifying as QSECOFR — IBM i's highest authority. No CVE, no IBM advisory, and affected version list is not stated.
Affected: not stated as a version list — tested against a Db2 Mirror GUI WAR on IBM i V7R5 with a late-2025 GUI build timestamp
How to Test: Check whether you run the IBM Db2 Mirror for i GUI (a Db2Mirror.war deployed on the IBM i administrative Liberty instance) and whether its web interface is network-reachable. Indicators from the report: requests to /Db2MirrorServlet with a semicolon path parameter (e.g. /Db2MirrorServlet;x/...), requests carrying skipVald=yes/true, and unauthenticated calls that still return application init JSON (getAppInitData) rather than 401/403.
How to Mitigate: Until IBM issues a fix, restrict the Db2 Mirror for i Liberty GUI to trusted administrative networks (firewall/VPN), and monitor for the semicolon-path and skipVald request patterns above; apply the IBM PTF/advisory as soon as one is published.
Evidence: Silent Signal write-up
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
