Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

By HackNews Team

Sep 17, 2026

3 min read

403 words

HACKNEWS

Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

Critical Issabel Framework Vulnerability Exploited in the Wild

A critical security vulnerability in Issabel Framework, a web-based framework used by the open-source unified communications PBX software, is being actively exploited.

The vulnerability, tracked as CVE-2026-89026, has a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3. It could allow an unauthenticated remote attacker to execute arbitrary operating system commands on vulnerable systems.

Hard-Coded JWT Key Enables Remote Code Execution

The vulnerability is caused by a hard-coded JSON Web Token (JWT) signing key in the pbxapi/index.php file.

According to VulnCheck, the same signing key is present across Issabel installations. This allows an unauthenticated attacker to forge valid bearer tokens without needing legitimate credentials.

An attacker can then use the forged token to access the following API endpoint:

/pbxapi/manager/originate

By supplying the System application parameter, an attacker can potentially cause Asterisk to execute arbitrary operating system commands with the privileges of the Asterisk user.

This makes the vulnerability particularly serious because exploitation does not require prior authentication.

Vulnerability Fixed in August

Issabel developers released a patch for the vulnerability on August 1, 2026.

The fix removes the hard-coded JWT signing key:

da893kasdfam43k29akdkfaFFlsdfhj23rasdf

and replaces it with a JWT key stored in:

/etc/issabel.conf

This prevents attackers from using the same known signing key to forge authentication tokens across installations.

Exploitation Detected in September

According to VulnCheck, the Shadowserver Foundation first observed exploitation of CVE-2026-89026 on September 9, 2026.

At present, there are no publicly available details about how the vulnerability is being exploited in real-world attacks, who is behind the activity, or how many Issabel systems may have been targeted.

The discovery of active exploitation makes unpatched Issabel installations a significant security concern.

What Issabel Users Should Do

Administrators running Issabel Framework should:

Apply the latest available security fixes immediately.
Check whether the system is running a vulnerable version of Issabel Framework.
Review authentication and API logs for suspicious access to /pbxapi/manager/originate.
Investigate unexpected Asterisk processes or operating system commands.
Review systems for signs of unauthorized access or persistence.
Restrict exposure of PBX management interfaces to trusted networks wherever possible.

Organizations that cannot immediately patch internet-facing Issabel systems should prioritize those systems for remediation and investigate them for signs of compromise.