Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.
VulnCheck reported active exploitation of CVE-2026-89026 (CVSS v3.1 9.8) in Issabel Framework, the web framework for the open-source Issabel unified communications PBX. A hard-coded HS256 JWT signing key identical across every installation lets unauthenticated attackers forge bearer tokens and abuse the /pbxapi/manager/originate endpoint, causing Asterisk to execute arbitrary OS commands as the Asterisk user. A patch replacing the hard-coded key with one stored in /etc/issabel.conf shipped August 1, 2026, and the Shadowserver Foundation first observed exploitation on September 9, 2026. Details on real-world abuse, attribution, and scale remain unknown.
- Hard-coded HS256 JWT signing key is identical across all Issabel Framework installations
- Forged tokens hit /pbxapi/manager/originate, making Asterisk run OS commands as the Asterisk user
- Patch released August 1, 2026 replaces the key with one stored in /etc/issabel.conf
- Shadowserver Foundation first observed exploitation on September 9, 2026
- CVEs
- CVE-2026-89026
- Products
- Issabel FrameworkAsterisk
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-89026 | Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework | 9.3 | 3% | PoC ×2 |
From the original article
1 min read at thehackernews.com
A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The vulnerability in question is CVE-2026-89026 (CVSS v3. 1 score: 9.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.