Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild
Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.
CVE-2026-89026 (CVSS v4 9.3) stems from a hard-coded HS256 JWT signing key in Issabel Framework's pbxapi/index.php, letting unauthenticated attackers forge bearer tokens and execute OS commands through the Asterisk Manager Interface originate endpoint. Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected. Shadowserver Foundation first observed exploitation on September 9, 2026, and VulnCheck added the flaw to its Known Exploited Vulnerabilities database.
- Hard-coded shared HS256 JWT key (CWE-321) enables forging of valid bearer tokens without any account.
- Attack invokes the Asterisk System application via pbxapi/manager/originate for arbitrary OS command execution as the Asterisk user.
- Shadowserver observed exploitation starting September 9, 2026; VulnCheck rated it critical and added it to KEV.
- Admins should patch to the fixed commit, restrict PBX API exposure, and hunt for suspicious token and originate activity.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-89026 | Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework The Issabel Framework that powers Issabel PBX ships a hard-coded HS256 JWT signing key in the pbxapi index.php file, and this key is identical across every installation. An unauthenticated remote attacker can exploit this to forge valid bearer tokens and call the manager originate endpoint with the System application parameter, which causes Asterisk to execute arbitrary operating-system commands as the Asterisk user. The flaw affects all Issabel PBX deployments running framework code from before commit b97dbaf. Exploitation is actively occurring: the Shadowserver Foundation first observed attacks on 2026-09-09. No public proof-of-concept is known, but exploitation is confirmed in the wild and defenders should treat internet-exposed Issabel systems as compromised until verified otherwise. Do: Update Issabel to builds containing framework commit b97dbaf or later, which removes the shared hard-coded JWT key. Until patched, block or restrict internet access to the Issabel web interface and pbxapi endpoints (VPN/IP allowlisting) and disable the manager originate System application if not needed. Audit Asterisk logs for unexpected originate actions and System-channel command executions since at least 2026-09-09, and rotate credentials on any system showing signs of compromise. | 9.3 | — |
| moderatelikely ≈1,000–5,000 internet-exposed Issabel PBX servers |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| sha1 | b97dbaf0b71c1c36f841e672b664afbeb02773bd | nerability affects Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. The Shadowserver Foundation first observed exploitation ac |
Full article560 words · extracted from cybersecuritynews.com · click to collapse
A critical vulnerability in the Issabel Framework, which supports Issabel PBX deployments, is being actively exploited in the wild. The flaw, tracked as CVE-2026-89026, allows unauthenticated remote attackers to execute OS commands on vulnerable PBX servers by forging authentication tokens.
VulnCheck rated the issue critical with a CVSS v4 score of 9.3. The vulnerability affects Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd.
The Shadowserver Foundation first observed exploitation activity on September 9, 2026, making rapid patching critical for organizations running internet-exposed Issabel PBX systems.
The vulnerability exists because the Issabel Framework included a hard-coded HS256 JSON Web Token signing key in the pbxapi/index.php file.
Because the same secret key was present across affected installations, an attacker could generate a bearer token that appears legitimate to a vulnerable Issabel server. JWTs are commonly used to verify that a request was authorized. In this case, the shared signing key breaks that security model.
An attacker does not need a valid Issabel account, password, or prior access to the PBX environment. Instead, they can create a forged token and submit requests to exposed API endpoints.
Issabel PBX Vulnerability Exploited
The issue is categorized as CWE-321, Use of Hard-coded Cryptographic Key. Hard-coded secrets are especially dangerous in products deployed by multiple organizations because disclosing one embedded key can put every unpatched deployment at risk.
After generating a valid-looking bearer token, an attacker can target the pbxapi/manager/originate endpoint. This endpoint interacts with the Asterisk Manager Interface functionality used by the PBX platform.
The attacker can reportedly invoke the System application through the originate request. That action causes Asterisk to run arbitrary operating-system commands under the permissions of the Asterisk user account.
This access could let an attacker download malware, establish persistence, steal call records or PBX configuration data, alter dial plans, misuse telephony resources, or move deeper into the organization’s network.
The exact impact depends on the privileges assigned to the Asterisk service account and the surrounding server configuration.
Because the attack can be performed remotely without authentication and does not require user interaction, internet-facing Issabel deployments face the highest immediate exposure.
Issabel administrators should update the Issabel Framework to a version containing the security fix associated with commit b97dbaf0b71c1c36f841e672b664afbeb02773bd.
Organizations should confirm that their installation no longer contains the vulnerable shared JWT signing key and that the patched framework code is deployed in the live PBX environment.
Security teams should also restrict access to PBX administration and API interfaces. The pbxapi endpoints and Asterisk management services should not be broadly reachable from the public internet.
Where remote administration is necessary, organizations should use VPN access, IP allowlists, strong authentication, and network segmentation. VulnCheck has also added the vulnerability to its Known Exploited Vulnerabilities database, underscoring the need for defenders to prioritize remediation.
Administrators should review web-server, Issabel, Asterisk, and endpoint logs for suspicious bearer-token activity, unusual originate requests, execution of the System application, unexpected shell commands, or outbound connections from the PBX server.
Treat any evidence of compromise as an incident requiring credential rotation, forensic review, and rebuilding affected systems where necessary.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/issabel-pbx-command-execution-vulnerability/