Issabel Framework flaw exploited to run OS commands

A critical vulnerability in the Issabel Framework, a web-based control interface for the open-source unified communications PBX software, is being actively exploited by attackers, according to a security alert from VulnCheck. A PBX, or private branch exchange, is a private telephone system used inside an organization, and the Issabel Framework provides a web interface for managing it.

The flaw, tracked as CVE-2026-89026, carries a CVSS v3.1 severity score of 9.8 and a CVSS v4.0 score of 9.3, placing it in the critical range. CVSS, or Common Vulnerability Scoring System, is a standard way to rate how serious a security weakness is on a scale from 0 to 10. The root cause is a hard-coded JSON Web Token (JWT) signing key. A JWT is a compact digital token used to prove who is making a request, and its signature is checked using a secret key. In Issabel Framework, this secret key is baked directly into the pbxapi index.php file and is the same across every installation. That means an unauthenticated remote attacker can forge a valid JWT bearer token without knowing any password or other secret specific to a given system. A bearer token is simply a credential that grants access to whoever presents it.

According to VulnCheck, attackers use the forged token to call the manager endpoint /pbxapi/manager/originate with the System application parameter. An endpoint is a specific URL path in the web application that answers requests. This particular call causes Asterisk, the open-source communications engine used by Issabel, to execute arbitrary operating system commands as the Asterisk user. In practice, that gives the attacker the ability to run commands on the underlying server with the privileges of the Asterisk service account, which can lead to full compromise of the system.

A patch for the vulnerability was released on August 1, 2026. The fix removes the hard-coded JWT key, which is the string da893kasdfam43k29akdkfaFFlsdfhj23rasdf, and instead reads a unique JWT key from the file /etc/issabel.conf. This change means each installation has its own secret key, so a forged token that works on one system will not be valid on another.

The Shadowserver Foundation, which monitors internet-wide threats, first observed exploitation of CVE-2026-89026 on September 9, 2026. However, VulnCheck notes that there are currently no details on how the vulnerability is being abused in real-world attacks, who is behind them, or the scale of the exploitation. Users of Issabel Framework are advised to apply the latest fixes as soon as possible.

For website owners and businesses running internet-facing services, this case highlights a common danger: a secret key that is hard-coded into software is not secret at all. Even if you are not using Issabel, you should check whether any self-hosted web applications or PBX systems in your environment have pending security updates. AEU-I offers security-first IT, infrastructure and consulting services that can help organizations review and patch such systems before attackers find them.