A significant security flaw has surfaced in the Issabel Framework, a web-based platform utilized for open-source unified communications PBX software. The vulnerability, identified as CVE-2026-89026, has been actively exploited, posing substantial risks to users.
Understanding the Vulnerability
Tagged with a CVSS v3.1 score of 9.8 and v4.0 score of 9.3, this critical flaw allows unauthenticated remote attackers to execute arbitrary operating system commands. This is made possible due to a hard-coded JSON Web Token (JWT) signing key within the framework, according to a VulnCheck alert.
The flaw resides in the pbxapi index.php file, where an identical HS256 JWT signing key is embedded across all installations. This design flaw enables attackers to create valid bearer tokens without authentication, allowing them unauthorized access to system functions.
Exploitation and Mitigation
Attackers can exploit this vulnerability by using the forged token to interact with the manager ‘/pbxapi/manager/originate’ endpoint. This action can trigger the Asterisk user to execute arbitrary OS commands, posing a severe security risk.
In response, a patch was released on August 1, 2026, which addresses the flaw by replacing the hard-coded JWT key with one stored in the ‘/etc/issabel.conf’ file. This update is crucial for safeguarding systems against potential attacks.
Current Exploitation Observations
The Shadowserver Foundation detected the first instance of this vulnerability being exploited on September 9, 2026. However, details regarding the methods of real-world exploitation, the perpetrators, and the full extent of the attack remain unclear.
To combat these threats, Issabel Framework users are strongly encouraged to implement the latest security patches to ensure their systems are protected against unauthorized access and command execution.
By understanding and addressing this vulnerability promptly, organizations can reduce the risk of exploitation and maintain the security of their communications infrastructure.
