Reported by 9 outlets

Issabel PBX remote code execution exploited in active attacks

hot0.0

Why this score

Breadth: 2.00 / 2.0 · 9 sources
Authority: 1.80 / 2.0 · best outlet weight
Severity: 5.00 / 5.0 · CVSS + content signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.28 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.00 / 1.5 · reddit signal
Score: 0.0 / 10 = base × recency + community

securityonline.infovulncheck.comthehackerwire.comcyberpress.orgthehackernews.comcyberworldops.eunvd.nist.govcybersecurefox.comgithub.com CVE-2026-89026 desk first seen 28d ago

Desk analysis

CVE-2026-89026 is a hard-coded HS256 JWT signing key embedded in pbxapi/index.php of the Issabel Framework, tracked as CWE-321, affecting all versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. The same key ships in every installation, so an unauthenticated remote attacker can forge a bearer token and reach the pbxapi/manager/originate endpoint. Submitting the System application parameter through that endpoint causes Asterisk to execute arbitrary OS commands as the Asterisk user, not just PBX functions. The vulnerability carries a CVSS v4 score of 9.3 and a CVSS v3.1 score of 9.8 across sources; active exploitation is confirmed by multiple outlets, with Shadowserver Foundation evidence first observed on 2026-09-09.

The event list spells out the kill chain, but it does not measure exposure. Every vulnerable PBX installation shares the identical signing key, which means there is no per-instance defense; the attacker does not need credentials, a local foothold, or user interaction. Because Issabel is an open-source platform commonly self-hosted by small telecommunications operators and call centers, a single forged token exposes the underlying server and the PBX management layer simultaneously. The story earns its place today not only because exploitation is active, but because the fix is a configuration change rather than a binary patch, so many administrators running older commits may miss it entirely, leaving long-tail exposure even after the advisory circulates.

Defenders should upgrade to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd or later, which removes the hard-coded key and reads pbxapijwtsecret from /etc/issabel.conf. Until the patch is applied, restrict inbound access to pbxapi/index.php and the manager originate endpoint at the network layer, and verify that /etc/issabel.conf exists with a properly generated base64-encoded secret of at least 32 random bytes. For hunting, monitor Asterisk logs for unexpected originate requests containing the System application parameter, inspect web server logs for forged JWT bearer tokens hitting pbxapi/index.php, and look for OS-level process spawning by the Asterisk user. No named threat actor or victim count has been published, so telemetry from shadow server observations on 2026-09-09 is the best temporal anchor.

Watch for two shifts. First, whether exploitation moves from generic OS command execution to targeted PBX function abuse, since the forged admin token also grants access to call management features. Second, whether self-hosted deployments adopt the configuration-based patch quickly, because the fix requires administrators to generate and store pbxapijwtsecret in /etc/issabel.conf rather than simply applying a binary update, which increases the risk that vulnerable instances persist unpatched for weeks.

Timeline

original reporting

An Issabel PBX vulnerability exploited in active attacks allows remote code execution. Patch this Issabel PBX vulnerability to secure system

securityonline.info · 27d ago · September 16th, 2026

An Issabel PBX vulnerability exploited in active attacks allows remote code execution. Patch this Issabel PBX vulnerability to secure system

via Mastodon https://securityonline.info/issabel-pbx-vulnerability-exploited/?utm_source=mastodon&utm_medium=jetpack_social
update from vulncheck.com

Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate

vulncheck.com · 29d ago · September 15th, 2026

VulnCheck advisory for CVE-2026-89026 (CVSS 9.3, CWE-321) documents a hard-coded HS256 JWT signing key in pbxapi/index.php identical across all Issabel Framework installations before commit b97dbaf. The advisory notes exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09, six days before the story's first_seen. A forged bearer token allows unauthenticated remote attackers to call pbxapi/manager/originate with the System application parameter, causing Asterisk to execute arbitrary OS commands.
update from www.thehackerwire.com

🔴 CVE-2026-89026 - Critical (9.8) The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a

www.thehackerwire.com · 28d ago · September 15th, 2026

🔴 CVE-2026-89026 - Critical (9.8) The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a

via Mastodon https://www.thehackerwire.com/vulnerability/CVE-2026-89026/
update from cyberpress.org

Issabel PBX JWT Key Flaw Enables Unauthenticated Remote Code Execution

cyberpress.org · 27d ago · September 16th, 2026

Tracked as CVE-2026-89026, the vulnerability affects Issabel Framework versions prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd . The issue carries a CVSS v4 score of 9.3 and is classified as CWE-321, “Use of Hard-coded Cryptographic Key.” Issabel is an open-source unified communications and PBX platform built around Asterisk. Its Framework component provides web-facing management capabilities, including APIs used to interact with PBX functions. Issabel PBX JWT Key Flaw According to the vulncheck , the affected pbxapi/index.php implementation contained a hard-coded HS256 key used to sign and validate JWT bearer tokens. Because every vulnerable installation embedded the same signing key, an attacker could create a JWT the affected PBX API would accept as legitimate. This removes the need for valid Issabel credentials, a local foothold, or user interaction. The forged token can then be used against the framework’s pbxapi/manager/originate endpoint. That endpoint is intended to create call origination requests through Asterisk Manager Interface functionality. However, an attacker who submits the System application parameter can reportedly cause Asterisk to run arbitrary commands on the underlying server. Successful exploitation results in co
mentioned by www.vulncheck.com

VulnCheck posted this yesterday: Issabel Framework Hard-coded JWT Key RCE via pbxapi/manager/originate https://www. vulncheck.com/advisories

www.vulncheck.com · 27d ago · September 16th, 2026
mentioned by thehackernews.com

🤖 CVE-2026-89026 (CVSS 9.8): unauthenticated OS command execution in the Issabel Framework PBX, now under active exploitation. Hard-coded fl

thehackernews.com · 27d ago · September 16th, 2026
mentioned by thehackernews.com

🤖 CVE-2026-89026 (CVSS 9.8): actively exploited flaw in Issabel Framework, an open-source PBX web framework, lets unauthenticated remote att

thehackernews.com · 27d ago · September 17th, 2026
update from cyberworldops.eu

Unauthenticated RCE in Issabel Framework (CVE-2026-89026) is being exploited in the wild. A hardcoded JWT secret in pbxapi/index.php allows

cyberworldops.eu · 27d ago · September 17th, 2026

A hardcoded JWT secret in pbxapi/index.php allows

via Mastodon https://cyberworldops.eu/en/one-shared-jwt-secret-exposes-issabel-pbx-servers-to-remote-command
mentioned by thehackernews.com

🤖 CVE-2026-89026 (CVSS 9.8): unauthenticated RCE in Issabel Framework PBX via hard-coded credentials — actively exploited in the wild. Patch

thehackernews.com · 26d ago · September 17th, 2026
mentioned by nvd.nist.gov

🤖 CVE-2026-89026 (CVSS 9.3): hard-coded HS256 JWT signing key in Issabel PBX, identical across all installs, lets unauthenticated attackers

nvd.nist.gov · 22d ago · September 21st, 2026
mentioned by cybersecurefox.com

CVE-2026-89026: RCE in Issabel Framework via JWT 🔗 https:// cybersecurefox.com/en/cve-2026 -89026-issabel-framework-jwt-rce # CVE -2026-8902

cybersecurefox.com · 21d ago · September 22nd, 2026
update from github.com

Issabel PBX Hard-Coded JWT Key Could Allow Admin Access

github.com · 17d ago · September 27th, 2026

Issabel PBX had a hard-coded JWT key that could let attackers forge admin tokens and gain access to PBX functions. Tracked as CVE-2026-89026, the issue has now been patched by moving the key into the system configuration submitted by /u/thechougala [link] [comments]

via reddit r/cybersecurity: Issabel PBX Hard-Coded JWT Key Could Allow Admin Access

Covered in

digest 2026-09-17