THE Shadowserver Foundation detected active exploitation of a critical Issabel PBX vulnerability on 9 September 2026. Tracked as CVE-2026-89026, the flaw affects Issabel Foundation’s Issabel Framework and has a CVSS v3 score of 9.8. All versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd are affected.
The vulnerability could allow unauthenticated attackers to execute operating-system commands on telephony appliances, potentially exposing calls and credentials or enabling further access to enterprise networks.
According to a VulnCheck advisory cited by the report, the framework uses the same hard-coded HS256 JSON Web Token signing key across installations. An attacker can therefore forge valid tokens without a password and call the `pbxapi/manager/originate` endpoint with the `System` application parameter. This causes Asterisk to execute arbitrary commands under the Asterisk user account. The report says exploitation was observed in the wild from September 2026, but provides no details about specific victims or attack groups.
Issabel resolved the issue in commit b97dbaf0b71c1c36f841e672b664afbeb02773bd by making signing keys unique to each deployment. Administrators should apply that update immediately and place web-management interfaces behind strict network firewalls.