A critical vulnerability in the Issabel Framework, which supports Issabel PBX deployments, is being actively exploited in the wild. The flaw, tracked as CVE-2026-89026, allows unauthenticated remote attackers to execute OS commands on vulnerable PBX servers by forging authentication tokens.
VulnCheck rated the issue critical with a CVSS v4 score of 9.3. The vulnerability affects Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd.
The Shadowserver Foundation first observed exploitation activity on September 9, 2026, making rapid patching critical for organizations running internet-exposed Issabel PBX systems.
The vulnerability exists because the Issabel Framework included a hard-coded HS256 JSON Web Token signing key in the pbxapi/index.php file.
Because the same secret key was present across affected installations, an attacker could generate a bearer token that appears legitimate to a vulnerable Issabel server. JWTs are commonly used to verify that a request was authorized. In this case, the shared signing key breaks that security model.
An attacker does not need a valid Issabel account, password, or prior access to the PBX environment. Instead, they can create a forged token and submit requests to exposed API endpoints.
Issabel PBX Vulnerability Exploited
The issue is categorized as CWE-321, Use of Hard-coded Cryptographic Key. Hard-coded secrets are especially dangerous in products deployed by multiple organizations because disclosing one embedded key can put every unpatched deployment at risk.
After generating a valid-looking bearer token, an attacker can target the pbxapi/manager/originate endpoint. This endpoint interacts with the Asterisk Manager Interface functionality used by the PBX platform.
The attacker can reportedly invoke the System application through the originate request. That action causes Asterisk to run arbitrary operating-system commands under the permissions of the Asterisk user account.
This access could let an attacker download malware, establish persistence, steal call records or PBX configuration data, alter dial plans, misuse telephony resources, or move deeper into the organization’s network.
The exact impact depends on the privileges assigned to the Asterisk service account and the surrounding server configuration.
Because the attack can be performed remotely without authentication and does not require user interaction, internet-facing Issabel deployments face the highest immediate exposure.
Issabel administrators should update the Issabel Framework to a version containing the security fix associated with commit b97dbaf0b71c1c36f841e672b664afbeb02773bd.
Organizations should confirm that their installation no longer contains the vulnerable shared JWT signing key and that the patched framework code is deployed in the live PBX environment.
Security teams should also restrict access to PBX administration and API interfaces. The pbxapi endpoints and Asterisk management services should not be broadly reachable from the public internet.
Where remote administration is necessary, organizations should use VPN access, IP allowlists, strong authentication, and network segmentation. VulnCheck has also added the vulnerability to its Known Exploited Vulnerabilities database, underscoring the need for defenders to prioritize remediation.
Administrators should review web-server, Issabel, Asterisk, and endpoint logs for suspicious bearer-token activity, unusual originate requests, execution of the System application, unexpected shell commands, or outbound connections from the PBX server.
Treat any evidence of compromise as an incident requiring credential rotation, forensic review, and rebuilding affected systems where necessary.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
The post Critical Issabel PBX Command Execution Vulnerability Exploited in the Wild appeared first on Cyber Security News.