A dangerous security flaw in Issabel Framework’s PBX system, referenced as CVE-2026-89026, is currently being exploited in the wild. This vulnerability allows attackers with no valid credentials to run arbitrary OS commands on exposed servers by forging authentication tokens. The issue impacts versions of Issabel Framework predating a specific commit identified as b97dbaf0b71c1c36f841e672b664afbeb02773bd, and has received a critical CVSS v4 severity rating of 9.3.
What’s going wrong
The core of the vulnerability lies in a hard-coded JSON Web Token (JWT) signing key baked into the pbxapi/index.php file. Since this HS256 signing key is identical across all affected installations, an attacker can fabricate a bearer token that passes verification. That token allows access to API endpoints without requiring any legitimate login or prior access to the PBX system.
Attackers can leverage this fake token to reach the pbxapi/manager/originate endpoint, which interfaces with the Asterisk Manager Interface. Through this endpoint it’s possible to trigger the System application, thereby executing arbitrary system commands as the Asterisk user. Potentially, attackers could download malware, steal PBX configurations or call logs, tweak dial plans, abuse telephony resources, or spread laterally in the network—depending on how the Asterisk service and the host are configured.
Risk exposure and real-world impact
Shadowserver Foundation reported that exploitation attempts began as early as September 9, 2026. Since the attack requires no user interaction and works remotely without authentication, deployments of Issabel Framework that are internet-facing are particularly at risk. Any PBX server directly reachable from the public internet is exposed immediately; internal or segmented setups still need scrutiny.
Mitigation steps and defense
The fixed version of the framework is found in the commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. Administrators should apply that update right away and verify the deployed code no longer includes the shared JWT signing key.
Best practices include limiting external access to PBX administration and API endpoints; ideally these should not be publicly routable. If remote management is necessary, using VPNs, IP allowlists, strong authentication, and network segmentation is essential. Additional hygiene steps involve reviewing logs—look for unusual originate requests, bearer tokens, or unexpected commands executed via Asterisk—and treating any sign of compromise as a serious incident, potentially requiring credential rotation and system rebuilds.
The discovery has already triggered action: the vulnerability has been added to VulnCheck’s Known Exploited Vulnerabilities list, underscoring the urgency for organizations using Issabel Framework to move quickly and apply the patch.
While hard-coded secrets aren’t new, this case highlights how one weak link—in this instance a shared JWT key—can open wide access to otherwise protected systems. Organisations relying on VoIP or PBX platforms must regularly audit code for baked-in keys, enforce least privilege on service accounts, and isolate PBX infrastructure. Consider deploying intrusion detection for API misuse and token abuse. Ultimately, a few precautionary steps today can prevent costly breaches tomorrow.
