Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

highExploit / PoC exploited in the wildimportance 74CVE-2026-89026

AI summary · glm-5.3-flash

Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.

VulnCheck reported active exploitation of CVE-2026-89026 (CVSS v3.1 9.8) in Issabel Framework, the web framework for the open-source Issabel unified communications PBX. A hard-coded HS256 JWT signing key identical across every installation lets unauthenticated attackers forge bearer tokens and abuse the /pbxapi/manager/originate endpoint, causing Asterisk to execute arbitrary OS commands as the Asterisk user. A patch replacing the hard-coded key with one stored in /etc/issabel.conf shipped August 1, 2026, and the Shadowserver Foundation first observed exploitation on September 9, 2026. Details on real-world abuse, attribution, and scale remain unknown.

Hard-coded HS256 JWT signing key is identical across all Issabel Framework installations
Forged tokens hit /pbxapi/manager/originate, making Asterisk run OS commands as the Asterisk user
Patch released August 1, 2026 replaces the key with one stored in /etc/issabel.conf
Shadowserver Foundation first observed exploitation on September 9, 2026

Read the original

VendorsVulnCheck Shadowserver Foundation

ProductsIssabel Framework Asterisk

ATT&CK T1190 Exploit Public-Facing Application T1059.004 Unix Shell

Tagsissabel asterisk jwt rce command-injection voip pbx active-exploitation

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-89026	Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework The Issabel Framework that powers Issabel PBX ships a hard-coded HS256 JWT signing key in the pbxapi index.php file, and this key is identical across every installation. An unauthenticated remote attacker can exploit this to forge valid bearer tokens and call the manager originate endpoint with the System application parameter, which causes Asterisk to execute arbitrary operating-system commands as the Asterisk user. The flaw affects all Issabel PBX deployments running framework code from before commit b97dbaf. Exploitation is actively occurring: the Shadowserver Foundation first observed attacks on 2026-09-09. No public proof-of-concept is known, but exploitation is confirmed in the wild and defenders should treat internet-exposed Issabel systems as compromised until verified otherwise. Do: Update Issabel to builds containing framework commit b97dbaf or later, which removes the shared hard-coded JWT key. Until patched, block or restrict internet access to the Issabel web interface and pbxapi endpoints (VPN/IP allowlisting) and disable the manager originate System application if not needed. Audit Asterisk logs for unexpected originate actions and System-channel command executions since at least 2026-09-09, and rotate credentials on any system showing signs of compromise.	9.3	—		Issabel Framework (Issabel PBX) all versions prior to commit b97dbaf	moderatelikely ≈1,000–5,000 internet-exposed Issabel PBX servers	1d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-89026

Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework

The Issabel Framework that powers Issabel PBX ships a hard-coded HS256 JWT signing key in the pbxapi index.php file, and this key is identical across every installation. An unauthenticated remote attacker can exploit this to forge valid bearer tokens and call the manager originate endpoint with the System application parameter, which causes Asterisk to execute arbitrary operating-system commands as the Asterisk user. The flaw affects all Issabel PBX deployments running framework code from before commit b97dbaf. Exploitation is actively occurring: the Shadowserver Foundation first observed attacks on 2026-09-09. No public proof-of-concept is known, but exploitation is confirmed in the wild and defenders should treat internet-exposed Issabel systems as compromised until verified otherwise.

Do: Update Issabel to builds containing framework commit b97dbaf or later, which removes the shared hard-coded JWT key. Until patched, block or restrict internet access to the Issabel web interface and pbxapi endpoints (VPN/IP allowlisting) and disable the manager originate System application if not needed. Audit Asterisk logs for unexpected originate actions and System-channel command executions since at least 2026-09-09, and rotate credentials on any system showing signs of compromise.

9.3

—

Issabel Framework (Issabel PBX) all versions prior to commit b97dbaf

moderatelikely ≈1,000–5,000 internet-exposed Issabel PBX servers

1d ago

Full article246 words · extracted from thehackernews.com · click to collapse

Ravie LakshmananSep 16, 2026Vulnerability / Web Security

A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation.

The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded JSON Web Token (JWT) signing key.

The Issabel Framework "contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens," VulnCheck said in an alert.

"Attackers can use the forged token to call the manager '/pbxapi/manager/originate' endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user."

A patch for the vulnerability was pushed on August 1, 2026, and plugs the flaw by replacing the hard-coded JWT key ("da893kasdfam43k29akdkfaFFlsdfhj23rasdf") with a JWT key stored in the "/etc/issabel.conf" file.

According to the cybersecurity company, the Shadowserver Foundation first observed exploitation of CVE-2026-89026 on September 9, 2026. That said, there are currently no details on how the vulnerability is being abused in real-world attacks, who is behind them, and the scale of such efforts.

Users of the Issabel Framework are advised to apply the latest fixes for optimal protection.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html