Issabel Framework vulnerability enables remote OS command execution

A critical security vulnerability in the Issabel Framework, a web-based component for open-source unified communications PBX software, is currently being actively exploited. The flaw, identified as CVE-2026-89026, carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3.

The vulnerability stems from a hard-coded HS256 JSON Web Token (JWT) signing key located in the ‘pbxapi/index.php’ file. Because this key is identical across all installations, unauthenticated remote attackers can forge valid bearer tokens. By using these forged tokens to call the ‘/pbxapi/manager/originate’ endpoint with the System application parameter, attackers can cause Asterisk to execute arbitrary operating system commands as the Asterisk user.

The Shadowserver Foundation first observed exploitation of this flaw on September 9, 2026. A patch was released on August 1, 2026, which addresses the issue by replacing the hard-coded key with one stored in the ‘/etc/issabel.conf’ file. Users are strongly advised to apply the latest updates to protect their systems.