Issabel: Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild

Critical Issabel PBX Vulnerability (CVE-2026-89026) Actively Exploited in the Wild

A critical vulnerability in the Issabel Framework, which powers Issabel PBX deployments, is under active exploitation. Tracked as CVE-2026-89026 (CVSS v4: 9.3), the flaw allows unauthenticated remote attackers to execute arbitrary OS commands on vulnerable servers by forging authentication tokens.

The vulnerability stems from a hard-coded HS256 JSON Web Token (JWT) signing key embedded in the pbxapi/index.php file, present across affected installations. Attackers can generate a malicious bearer token, bypassing authentication, and submit requests to exposed API endpoints specifically the pbxapi/manager/originate endpoint, which interacts with the Asterisk Manager Interface. This enables command execution under the Asterisk service account, potentially leading to malware deployment, data theft, or lateral movement within a network.

Exploitation was first observed by the Shadowserver Foundation on September 9, 2026, targeting internet-exposed Issabel PBX systems. The flaw (CWE-321) poses a severe risk due to its low attack complexity, requiring no user interaction or prior access.

Affected versions include Issabel Framework releases before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. Organizations are advised to patch immediately, verify the removal of the hard-coded key, and restrict access to PBX administration interfaces. Security teams should monitor logs for suspicious token activity, unusual originate requests, or unauthorized command execution.

VulnCheck has added the vulnerability to its Known Exploited Vulnerabilities database, emphasizing the urgency of remediation.

Source: https://cybersecuritynews.com/issabel-pbx-command-execution-vulnerability/

Issabel cybersecurity rating report: https://www.rankiteo.com/company/issabel

"id": "ISS1789568674",
"linkid": "issabel",
"type": "Vulnerability",
"date": "9/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"

{'affected_entities': [{'industry': 'Telecommunications/VoIP',
                        'name': 'Issabel PBX users',
                        'type': 'Organization'}],
 'attack_vector': 'Remote',
 'data_breach': {'data_exfiltration': 'Potential data theft'},
 'date_detected': '2026-09-09',
 'description': 'A critical vulnerability in the Issabel Framework, which '
                'powers Issabel PBX deployments, is under active exploitation. '
                'Tracked as CVE-2026-89026 (CVSS v4: 9.3), the flaw allows '
                'unauthenticated remote attackers to execute arbitrary OS '
                'commands on vulnerable servers by forging authentication '
                'tokens. The vulnerability stems from a hard-coded HS256 JSON '
                'Web Token (JWT) signing key embedded in the '
                '`pbxapi/index.php` file, enabling attackers to bypass '
                'authentication and submit requests to exposed API endpoints, '
                'leading to command execution under the Asterisk service '
                'account.',
 'impact': {'operational_impact': 'Potential malware deployment, data theft, '
                                  'or lateral movement within a network',
            'systems_affected': 'Issabel PBX servers'},
 'post_incident_analysis': {'corrective_actions': 'Remove hard-coded key, '
                                                  'apply patches, restrict '
                                                  'access to PBX interfaces',
                            'root_causes': 'Hard-coded HS256 JWT signing key '
                                           'in `pbxapi/index.php`'},
 'recommendations': 'Patch immediately, verify the removal of the hard-coded '
                    'key, restrict access to PBX administration interfaces, '
                    'and monitor logs for suspicious activity.',
 'references': [{'source': 'Shadowserver Foundation'},
                {'source': 'VulnCheck Known Exploited Vulnerabilities '
                           'database'}],
 'response': {'containment_measures': 'Patch immediately, verify removal of '
                                      'the hard-coded key, restrict access to '
                                      'PBX administration interfaces',
              'enhanced_monitoring': 'Monitor logs for suspicious token '
                                     'activity, unusual `originate` requests, '
                                     'or unauthorized command execution',
              'remediation_measures': 'Apply patches for Issabel Framework '
                                      'releases before commit '
                                      '`b97dbaf0b71c1c36f841e672b664afbeb02773bd`'},
 'title': 'Critical Issabel PBX Vulnerability (CVE-2026-89026) Actively '
          'Exploited in the Wild',
 'type': 'Vulnerability Exploitation',
 'vulnerability_exploited': 'CVE-2026-89026 (CWE-321: Use of Hard-coded '
                            'Cryptographic Key)'}