CVE-2026-89026 is a critical security flaw with a CVSS score of 9.8 that affects the Issabel Framework, a web-based framework for open-source unified communications PBX software. The vulnerability allows an unauthenticated remote attacker to execute arbitrary operating system commands by exploiting a hard-coded JSON Web Token (JWT) signing key. This JWT key is identical across every installation and can be forged to call the manager endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. The flaw was first observed being exploited on September 9, 2026, by the Shadowserver Foundation, although there are currently no details available on how it is being abused in real-world attacks or who is behind them. Users of the Issabel Framework are advised to apply the latest fixes for optimal protection.
We recommend you to update Issabel Framework to the latest available version.[/subscribe_to_unlock_form]
CVE-2026-89026 is a critical security flaw with a CVSS score of 9.8 that affects the Issabel Framework, a web-based framework for open-source unified communications PBX software. The vulnerability allows an unauthenticated remote attacker to execute arbitrary operating system commands by exploiting a hard-coded JSON Web Token (JWT) signing key. This JWT key is identical across every installation and can be forged to call the manager endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. The flaw was first observed being exploited on September 9, 2026, by the Shadowserver Foundation, although there are currently no details available on how it is being abused in real-world attacks or who is behind them. Users of the Issabel Framework are advised to apply the latest fixes for optimal protection.
We recommend you to update Issabel Framework to the latest available version.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]