Attackers Exploit Issabel Framework Flaw for Unauthenticated Command Execution
Summary
CVE-2026-89026, a critical Issabel Framework flaw involving a hard-coded JWT key, is being exploited to run commands without authentication. A patch was released August 1, 2026; Shadowserver first observed exploitation September 9.
Key points
- CVE-2026-89026 affects Issabel Framework, used with open-source unified communications PBX software, and has a CVSS v3.1 score of 9.8.
- A hard-coded HS256 JWT signing key shared across installations allows unauthenticated attackers to forge bearer tokens.
- Forged tokens can call the Asterisk manager endpoint and execute arbitrary OS commands as the Asterisk user.
- A patch released August 1, 2026, replaces the shared key with one stored in /etc/issabel.conf.
- Shadowserver Foundation first observed exploitation on September 9, 2026.
- The article says the attackers, real-world abuse details, and scale of exploitation are unknown; users are advised to apply the latest fixes.
Article Details
- Vulnerability Types
- Hard-coded cryptographic key
- Unauthenticated remote OS command execution
- Severity
- Critical; CVSS v3.1 9.8 and CVSS v4.0 9.3
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
CVE
Vendors
Products
AsteriskExploitation can trigger the Asterisk manager endpoint to run arbitrary OS commands as the Asterisk user.Issabel FrameworkA critical flaw in Issabel Framework, tracked as CVE-2026-89026, is being actively exploited to let unauthenticated attackers execute arbitrary OS commands by forging JWT bearer tokens with a hard-coded signing key.