CVE-2026-89026

The Issabel Framework that powers Issabel PBX ships a hard-coded HS256 JWT signing key in the pbxapi index.php file, and this key is identical across every installation. An unauthenticated remote attacker can exploit this to forge valid bearer tokens and call the manager originate endpoint with the System application parameter, which causes Asterisk to execute arbitrary operating-system commands as the Asterisk user. The flaw affects all Issabel PBX deployments running framework code from before commit b97dbaf. Exploitation is actively occurring: the Shadowserver Foundation first observed attacks on 2026-09-09. No public proof-of-concept is known, but exploitation is confirmed in the wild and defenders should treat internet-exposed Issabel systems as compromised until verified otherwise.

What to do: Update Issabel to builds containing framework commit b97dbaf or later, which removes the shared hard-coded JWT key. Until patched, block or restrict internet access to the Issabel web interface and pbxapi endpoints (VPN/IP allowlisting) and disable the manager originate System application if not needed. Audit Asterisk logs for unexpected originate actions and System-channel command executions since at least 2026-09-09, and rotate credentials on any system showing signs of compromise.