Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild
Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.
CVE-2026-89026 (CVSS v4 9.3) stems from a hard-coded HS256 JWT signing key in Issabel Framework's pbxapi/index.php, letting unauthenticated attackers forge bearer tokens and execute OS commands through the Asterisk Manager Interface originate endpoint. Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected. Shadowserver Foundation first observed exploitation on September 9, 2026, and VulnCheck added the flaw to its Known Exploited Vulnerabilities database.
- Hard-coded shared HS256 JWT key (CWE-321) enables forging of valid bearer tokens without any account.
- Attack invokes the Asterisk System application via pbxapi/manager/originate for arbitrary OS command execution as the Asterisk user.
- Shadowserver observed exploitation starting September 9, 2026; VulnCheck rated it critical and added it to KEV.
- Admins should patch to the fixed commit, restrict PBX API exposure, and hunt for suspicious token and originate activity.
- CVEs
- CVE-2026-89026
- Products
- Issabel PBX
- Organizations
- VulnCheckShadowserver Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-89026 | Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework | 9.3 | 3% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha1 | b97dbaf0b71c1c36f841e672b664afbeb02773bd | nerability affects Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. The Shadowserver Foundation first observed exploitation ac |
From the original article
2 min read at cybersecuritynews.com
A critical vulnerability in the Issabel Framework, which supports Issabel PBX deployments, is being actively exploited in the wild. The flaw, tracked as CVE-2026-89026, allows unauthenticated remote attackers to execute OS commands on vulnerable PBX servers by forging authentication tokens. VulnCheck rated the issue critical with a CVSS v4 score of 9.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.