A crucial safety flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software program, has come below lively exploitation.
The vulnerability in query is CVE-2026-89026 (CVSS v3.1 rating: 9.8/CVSS v4.0 rating: 9.3), which might permit an unauthenticated distant attacker to execute arbitrary working system (OS) instructions by making the most of a hard-coded JSON Internet Token (JWT) signing key.
The Issabel Framework “accommodates a hard-coded HS256 JWT signing key within the pbxapi index.php file that’s an identical throughout each set up, permitting unauthenticated distant attackers to forge legitimate bearer tokens,” VulnCheck stated in an alert.
“Attackers can use the cast token to name the supervisor ‘/pbxapi/supervisor/originate’ endpoint with the System software parameter, inflicting Asterisk to execute arbitrary OS instructions because the Asterisk consumer.”
A patch for the vulnerability was pushed on August 1, 2026, and plugs the flaw by changing the hard-coded JWT key (“da893kasdfam43k29akdkfaFFlsdfhj23rasdf”) with a JWT key saved within the “/and so forth/issabel.conf” file.
In line with the cybersecurity firm, the Shadowserver Basis first noticed exploitation of CVE-2026-89026 on September 9, 2026. That stated, there are at the moment no particulars on how the vulnerability is being abused in real-world assaults, who’s behind them, and the dimensions of such efforts.
Customers of the Issabel Framework are suggested to use the newest fixes for optimum safety.
