Story · 2 sources · 2 articlesfirst Sep 16, 13:12 UTCupdated Sep 16, 15:50 UTC (1h ago)

Actively Exploited CVE-2026-89026: Hard-Coded JWT Key in Issabel PBX Framework Enables Unauthenticated OS Command Execution

criticalExploit / PoCexploited in the wildimportance 78CVE-2026-89026

What's new: First merged summary for this story. Key developments: VulnCheck confirmed active exploitation of CVE-2026-89026, with Shadowserver Foundation first observing exploitation on September 9, 2026 — roughly five to six weeks after the fix shipped on August 1, 2026 — and the flaw was added to VulnCheck's KEV database. No prior summary existed.

Merged summary · glm-5.3-flash · rewritten as coverage arrives

Unauthenticated attackers are exploiting CVE-2026-89026 (CVSS v4 9.3 / v3.1 9.8), a hard-coded HS256 JWT signing key in Issabel Framework, forging bearer tokens to execute arbitrary OS commands via Asterisk; exploitation has been observed in the wild since…

VulnCheck reported active exploitation of CVE-2026-89026, a vulnerability in Issabel Framework, the web framework for the open-source Issabel unified communications PBX. The flaw (CWE-321) stems from a hard-coded HS256 JWT signing key in pbxapi/index.php that is identical across every installation, allowing unauthenticated attackers to forge valid bearer tokens without any account. Attackers abuse the /pbxapi/manager/originate endpoint, invoking the Asterisk System application via the Asterisk Manager Interface to execute arbitrary OS commands as the Asterisk user. Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected. A patch released August 1, 2026 replaces the hard-coded key with one stored in /etc/issabel.conf. The Shadowserver Foundation first observed exploitation on September 9, 2026, and VulnCheck rated the flaw critical and added it to its Known Exploited Vulnerabilities (KEV) database. Details on real-world abuse, attribution, and scale remain unknown. Admins are advised to patch to the fixed commit, restrict PBX API exposure, and hunt for suspicious token and originate activity.

CVE-2026-89026 is a hard-coded HS256 JWT signing key flaw (CWE-321) in Issabel Framework's pbxapi/index.php, the web framework for the open-source Issabel unified communications PBX
Sources differ on severity scoring: Report 1 cites CVSS v4 9.3 while Report 2 cites CVSS v3.1 9.8; VulnCheck rated the flaw critical
The hard-coded JWT signing key is identical across all Issabel Framework installations, enabling unauthenticated attackers to forge valid bearer tokens without any account
Forged tokens hit the /pbxapi/manager/originate endpoint, invoking the Asterisk System application via the Asterisk Manager Interface to run arbitrary OS commands as the Asterisk user
Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected
A patch released August 1, 2026 replaces the hard-coded key with one stored in /etc/issabel.conf
Shadowserver Foundation first observed exploitation in the wild on September 9, 2026; VulnCheck added the flaw to its Known Exploited Vulnerabilities (KEV) database
Details on real-world abuse, attribution, and scale remain unknown

VendorsIssabel Asterisk VulnCheck Shadowserver Foundation

ProductsIssabel PBX Issabel Framework Asterisk

OrganizationsVulnCheck Shadowserver Foundation

Coverage timelineoldest first · each row is one article

13:12 UTC · 4h ago
Cyber Security News· 78
Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild
Unauthenticated attackers exploit CVE-2026-89026 in Issabel PBX via forged JWT tokens to run OS commands; exploitation observed since September 9.
15:50 UTC · 1h ago
The Hacker News· 74
Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
Attackers actively exploit CVE-2026-89026, a hard-coded JWT key flaw enabling unauthenticated OS command execution on Issabel PBX systems.

Vulnerabilities in this storyAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2026-89026	Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework The Issabel Framework that powers Issabel PBX ships a hard-coded HS256 JWT signing key in the pbxapi index.php file, and this key is identical across every installation. An unauthenticated remote attacker can exploit this to forge valid bearer tokens and call the manager originate endpoint with the System application parameter, which causes Asterisk to execute arbitrary operating-system commands as the Asterisk user. The flaw affects all Issabel PBX deployments running framework code from before commit b97dbaf. Exploitation is actively occurring: the Shadowserver Foundation first observed attacks on 2026-09-09. No public proof-of-concept is known, but exploitation is confirmed in the wild and defenders should treat internet-exposed Issabel systems as compromised until verified otherwise. Do: Update Issabel to builds containing framework commit b97dbaf or later, which removes the shared hard-coded JWT key. Until patched, block or restrict internet access to the Issabel web interface and pbxapi endpoints (VPN/IP allowlisting) and disable the manager originate System application if not needed. Audit Asterisk logs for unexpected originate actions and System-channel command executions since at least 2026-09-09, and rotate credentials on any system showing signs of compromise.	9.3	—		Issabel Framework (Issabel PBX) all versions prior to commit b97dbaf	moderatelikely ≈1,000–5,000 internet-exposed Issabel PBX servers	1d ago

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2026-89026

Hard-Coded JWT Key Enables Unauthenticated RCE in Issabel PBX Framework

The Issabel Framework that powers Issabel PBX ships a hard-coded HS256 JWT signing key in the pbxapi index.php file, and this key is identical across every installation. An unauthenticated remote attacker can exploit this to forge valid bearer tokens and call the manager originate endpoint with the System application parameter, which causes Asterisk to execute arbitrary operating-system commands as the Asterisk user. The flaw affects all Issabel PBX deployments running framework code from before commit b97dbaf. Exploitation is actively occurring: the Shadowserver Foundation first observed attacks on 2026-09-09. No public proof-of-concept is known, but exploitation is confirmed in the wild and defenders should treat internet-exposed Issabel systems as compromised until verified otherwise.

Do: Update Issabel to builds containing framework commit b97dbaf or later, which removes the shared hard-coded JWT key. Until patched, block or restrict internet access to the Issabel web interface and pbxapi endpoints (VPN/IP allowlisting) and disable the manager originate System application if not needed. Audit Asterisk logs for unexpected originate actions and System-channel command executions since at least 2026-09-09, and rotate credentials on any system showing signs of compromise.

9.3

—

Issabel Framework (Issabel PBX) all versions prior to commit b97dbaf

moderatelikely ≈1,000–5,000 internet-exposed Issabel PBX servers

1d ago