Attackers Exploit Critical Issabel PBX Flaw to Run Commands Remotely

The Shadowserver Foundation detected active exploitation of a critical Issabel PBX vulnerability on 9 September 2026. Tracked as CVE-2026-89026, the flaw has a CVSSv3 score of 9.8 and affects Issabel Framework versions before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. It enables unauthenticated remote code execution on telephony appliances, potentially allowing attackers to compromise communications infrastructure.

According to a VulnCheck advisory cited in the report, Issabel’s framework API uses the same hard-coded HS256 JSON Web Token signing key in every installation. An attacker can use that key to forge a valid token without credentials, then call the `pbxapi/manager/originate` endpoint with the `System` application parameter. Asterisk consequently executes arbitrary operating-system commands with the privileges of the Asterisk user.

The report says the issue could enable eavesdropping, credential theft or further movement into private networks, although it does not provide details of specific victims or attack campaigns.

The vendor addressed the vulnerability in commit b97dbaf0b71c1c36f841e672b664afbeb02773bd by making signing keys unique to each deployment. Administrators should apply that update immediately and place web management interfaces behind strict network firewalls. The report describes exploitation as confirmed in the wild from September 2026.