Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

Ravie LakshmananSep 16, 2026Vulnerability / Web Security

A critical security vulnerability in Issabel Framework, a popular web-based framework for open-source unified communications PBX software, has recently been exploited by cybercriminals.

The specific vulnerability identified as CVE-2026-89026 (CVSS v3.1 score: 9.8/CVSS v4.0 score: 9.3) allows unauthorized remote attackers to execute malicious operating system (OS) commands by leveraging a hardcoded JSON Web Token (JWT) signing key.

The flaw in the Issabel Framework was discovered to have a hardcoded HS256 JWT signing key in the pbxapi index.php file, which remains the same across all installations. This oversight enables hackers to create valid bearer tokens without authentication, as highlighted in an alert by VulnCheck reportedly.

Exploiting the forged token, attackers can trigger the manager \’/pbxapi/manager/originate\’ endpoint with the System application parameter, leading to the execution of unauthorized OS commands within the Asterisk system.

A patch addressing the vulnerability was released on August 1, 2026. This patch resolves the issue by replacing the hardcoded JWT key (\”da893kasdfam43k29akdkfaFFlsdfhj23rasdf\”) with a dynamically generated JWT key stored in the \”/etc/issabel.conf\” file.

According to reports from the Shadowserver Foundation, exploitation of CVE-2026-89026 was first observed on September 9, 2026. However, details regarding the specific exploitation methods, threat actors involved, and the extent of these attacks are currently scarce.

All users of the Issabel Framework are strongly advised to apply the latest security updates to mitigate the risks associated with this critical vulnerability.