watchTowr reports active exploitation attempts using forged admin tokens, so an unpatched, internet-facing WSO2 gateway can be taken over without credentials by anyone replaying the technique.
The JWT authentication mechanism in WSO2 API Manager, Universal Gateway, Traffic Manager and API Control Plane accepts tokens signed with algorithms other than those configured, so an unauthenticated attacker can craft a token that passes validation. The result is unauthorized access up to administrative account takeover, with cross-tenant impact in multi-tenant deployments.
Affected: WSO2 API Manager 4.1.0 < 4.1.0.257; WSO2 API Manager 4.2.0 < 4.2.0.197; WSO2 API Manager 4.3.0 < 4.3.0.108; WSO2 API Manager 4.4.0 < 4.4.0.72; WSO2 Universal Gateway 4.5.0 < 4.5.0.57; WSO2 Universal Gateway 4.6.0 < 4.6.0.21; WSO2 Traffic Manager 4.5.0 < 4.5.0.56; WSO2 Traffic Manager 4.6.0 < 4.6.0.21; WSO2 API Control Plane 4.5.0 < 4.5.0.58; WSO2 API Control Plane 4.6.0 < 4.6.0.22
How to Test
Confirm the product and update level of every WSO2 API Manager, Universal Gateway, Traffic Manager and API Control Plane node against the fixed update levels above; anything below is vulnerable. Review gateway and key-manager authentication logs for accepted JWTs whose header algorithm differs from the configured signing algorithm, and audit recent administrative logins, new admin users, and API/application changes that no operator can account for.
How to Patch
Update to API Manager 4.1.0.257, 4.2.0.197, 4.3.0.108 or 4.4.0.72; Universal Gateway 4.5.0.57 or 4.6.0.21; Traffic Manager 4.5.0.56 or 4.6.0.21; API Control Plane 4.5.0.58 or 4.6.0.22, per WSO2 advisory WSO2-2026-5328. Until updated, restrict network access to the management and admin interfaces to trusted sources.
Sysdig, via The Hacker News on 2026-09-15, documented a fresh intrusion in which a human operator exploited this Marimo RCE and reached an SSH bastion within eight seconds, so any team still running a pre-0.23.0 Marimo instance reachable over the network should treat it as compromised-in-waiting.
Marimo versions before 0.23.0 expose a pre-authentication flaw that lets an unauthenticated remote attacker obtain shell access and run arbitrary system commands on the host serving the notebook. Twenty-one public exploits are catalogued in VulnCheck XDB.
Affected: marimo-team marimo < 0.23.0
How to Test
Check the installed marimo package version on every host that runs a notebook server; anything below 0.23.0 is vulnerable. Identify which marimo instances are reachable from outside the host (bound to a non-loopback interface or exposed through a proxy). On exposed instances, review process and shell history for unexpected commands spawned by the marimo server process, and — per the Sysdig-described attack chain — review SSH authentication logs on bastions and other hosts for logins originating from the notebook host.
How to Patch
Upgrade marimo to 0.23.0 or later on every host. Until upgraded, remove network exposure of the notebook server (bind to localhost only or restrict access to trusted addresses) — no other vendor mitigation is given in the dossier.
VulnCheck added this to its KEV catalog yesterday citing Shadowserver observations of exploitation beginning 2026-09-09, and any Issabel PBX exposing pbxapi with the old key can be fully compromised by a single forged token.
The Issabel Framework's pbxapi/index.php shipped an HS256 JWT signing key identical on every installation, so any remote attacker can forge a valid bearer token. With that token, the manager originate endpoint can be called with the System application to make Asterisk run arbitrary OS commands as the asterisk user.
Affected: Issabel Framework before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd
How to Test
Open framework/html/pbxapi/index.php on the PBX: if JWT_KEY is set to the literal string da893kasdfam43k29akdkfaFFlsdfhj23rasdf rather than read from pbxapijwtsecret in /etc/issabel.conf, the system is vulnerable. Check web server logs for requests to the pbxapi manager originate endpoint from unknown sources, review Asterisk logs for originate calls using the System application, and inspect the asterisk user's processes, cron entries and home directory for unexpected files.
How to Patch
Update the Issabel Framework to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd or later, then add a pbxapijwtsecret entry to /etc/issabel.conf containing at least 32 random bytes encoded as Base64 (the patched code refuses to start without it). If updating must wait, block external access to the pbxapi path at the firewall or web server.
Unverified public report · no CVERemote Code Executioncritical
A detailed, reproducible pre-auth chain against an administrative interface on IBM i is public with no CVE or vendor fix; exposed GUIs should be locked down before it is weaponized.
A researcher write-up shows an unauthenticated exploit chain in the IBM Db2 Mirror for i web interface. Adding a semicolon path parameter (e.g. /Db2MirrorServlet;x/...) makes the AuthFilter's rets[2].equals("Db2MirrorServlet") check miss the servlet while the container still routes the request, bypassing session, BuildTimeStamp and MN checks; a separate skipVald request parameter disables input validation without a login. From there action methods become reachable, leading to arbitrary Java/JSP execution in Liberty and, via a native helper, a local Db2 connection identifying as QSECOFR — IBM i's highest authority. No CVE, no IBM advisory, and affected version list is not stated.
Affected: not stated as a version list — tested against a Db2 Mirror GUI WAR on IBM i V7R5 with a late-2025 GUI build timestamp
How to Test
Check whether you run the IBM Db2 Mirror for i GUI (a Db2Mirror.war deployed on the IBM i administrative Liberty instance) and whether its web interface is network-reachable. Indicators from the report: requests to /Db2MirrorServlet with a semicolon path parameter (e.g. /Db2MirrorServlet;x/...), requests carrying skipVald=yes/true, and unauthenticated calls that still return application init JSON (getAppInitData) rather than 401/403.
How to Mitigate
Until IBM issues a fix, restrict the Db2 Mirror for i Liberty GUI to trusted administrative networks (firewall/VPN), and monitor for the semicolon-path and skipVald request patterns above; apply the IBM PTF/advisory as soon as one is published.