Attackers Exploiting Critical Issabel Framework Flaw for Remote Command Execution

Attackers are actively exploiting a critical security flaw in the Issabel Framework, an open-source unified communications PBX software, to execute operating system (OS) commands without authentication.

The vulnerability, tracked as CVE-2026-89026, carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3. The flaw enables unauthenticated remote attackers to forge valid bearer tokens by taking advantage of a hard-coded HS256 JSON Web Token (JWT) signing key.

Security researchers at VulnCheck identified that the framework contains a hard-coded JWT signing key within the pbxapi/index.php file that is identical across every installation. This allows attackers to forge tokens and call the /pbxapi/manager/originate endpoint using the System application parameter, which causes the Asterisk service to execute arbitrary OS commands with the privileges of the Asterisk user.

The Shadowserver Foundation first observed the active exploitation of CVE-2026-89026 on 9 September 2026. While exploitation has been confirmed, there is currently no detailed information regarding the identity of the threat actors or the full scale of the attacks.

Patch and Remediation

A patch for the vulnerability was released on 1 August 2026. The update mitigates the risk by replacing the hard-coded JWT key with a unique key stored in the /etc/issabel.conf file.

Organisations using the Issabel Framework are urged to apply the latest security updates immediately to prevent unauthorised remote command execution.