Active Exploitation Alert: Issabel PBX CVE-2026-89026 Allows Unauthenticated Remote OS Command Execution via Hard-Coded JWT Key

Executive Summary

A critical vulnerability in the Issabel Framework has been identified and is currently being exploited in the wild, enabling unauthenticated attackers to execute arbitrary operating system (OS) commands remotely. This flaw, tracked as CVE-2026-89026, arises from the use of a hard-coded JWT signing key within the Issabel PBX API, allowing adversaries to forge authentication tokens and gain unrestricted access to sensitive API endpoints. The vulnerability affects all versions of the Issabel Framework prior to the security patch introduced in commit b97dbaf. Public proof-of-concept (PoC) code is available, and exploitation has been observed targeting internet-facing deployments globally. Immediate action is required to mitigate risk, as attackers can leverage this flaw to compromise telephony infrastructure, pivot within networks, and potentially launch further attacks.

Threat Actor Profile

Current intelligence indicates that exploitation of the Issabel Framework flaw is opportunistic and widespread, rather than being attributed to a specific advanced persistent threat (APT) group. The tactics, techniques, and procedures (TTPs) observed align with those commonly used by financially motivated cybercriminals and ransomware operators who target VoIP and PBX infrastructure for initial access, lateral movement, and data exfiltration. The availability of public PoC code has lowered the barrier to entry, enabling both sophisticated and low-skilled actors to exploit vulnerable systems. While no direct attribution has been made, the attack patterns suggest a focus on mass exploitation for financial gain, disruption, or as a foothold for further malicious activity.

Technical Analysis of Malware/TTPs

The vulnerability in the Issabel Framework is rooted in the use of a static, hard-coded JWT signing key for HS256 signatures within the API authentication mechanism. This key, identical across all installations, allows any party with knowledge of the key to generate valid JWT tokens. The most critical API endpoint affected is /pbxapi/manager/originate, which accepts a System application parameter. By submitting a forged JWT token and a malicious payload to this endpoint, attackers can instruct the underlying Asterisk service to execute arbitrary OS commands as the asterisk user.

The exploitation process involves crafting a JWT token using the known static key (da893kasdfam43k29akdkfaFFlsdfhj23rasdf), then sending a POST request to the vulnerable endpoint with a command of the attacker’s choice. This results in the execution of the command on the target system without any authentication or user interaction. The attack does not require prior access or credentials, making it highly dangerous for any internet-exposed Issabel PBX instance.

Observed TTPs include the use of automated scripts to scan for and exploit vulnerable hosts, deployment of web shells or reverse shells for persistent access, and the execution of reconnaissance commands to enumerate system information and network topology. In some cases, attackers have been seen downloading additional malware or using the compromised PBX as a pivot point for lateral movement within the victim’s network.

Exploitation in the Wild

Active exploitation of CVE-2026-89026 has been confirmed by multiple reputable sources, including The Hacker News, VulnCheck, and the Shadowserver Foundation. The first signs of exploitation were observed in early September 2026, shortly after the public disclosure of the vulnerability and the release of PoC exploit code on GitHub. Attackers are leveraging the flaw to compromise internet-facing Issabel PBX deployments, with a focus on organizations that have not yet applied the security patch.

The attack surface is significant, as many organizations deploy Issabel PBX systems with public-facing interfaces for remote management and telephony services. The availability of automated exploitation tools has accelerated the rate of compromise, with reports of mass scanning and exploitation campaigns targeting vulnerable hosts worldwide. Indicators of compromise include unauthorized access to the /pbxapi/manager/originate endpoint, the presence of JWT tokens signed with the hard-coded key, and the execution of unexpected processes as the asterisk user.

Victimology and Targeting

The exploitation of the Issabel Framework flaw is indiscriminate, affecting organizations across various sectors and geographies. The primary targets are entities with internet-exposed Issabel PBX systems, including telecommunications providers, small and medium-sized businesses, call centers, and managed service providers. The lack of authentication required for exploitation means that any unpatched system is at risk, regardless of industry or location.

While there is no evidence of targeted attacks against specific sectors or high-profile organizations, the potential impact is significant. Compromised PBX systems can be used to intercept or reroute calls, conduct toll fraud, harvest sensitive information, or serve as a launchpad for further attacks within the victim’s network. Organizations with critical telephony infrastructure or regulatory compliance requirements are particularly vulnerable to operational disruption and data breaches resulting from this flaw.

Mitigation and Countermeasures

Immediate mitigation is essential to protect against exploitation of CVE-2026-89026. Organizations should update the Issabel Framework to the latest version, ensuring that the patch introduced in commit b97dbaf is applied. This update replaces the hard-coded JWT key with a unique, installation-specific key stored securely in /etc/issabel.conf, effectively closing the authentication bypass.

For systems where immediate patching is not feasible, network-level controls should be implemented to restrict access to the /pbxapi endpoint, allowing only trusted IP addresses or internal networks. Continuous monitoring of API access logs for unauthorized requests, JWT tokens signed with the known static key, and unusual process activity as the asterisk user is recommended to detect potential compromise. Organizations should also rotate any credentials or keys that may have been exposed and conduct a thorough review of system integrity.

Additional best practices include disabling unnecessary remote access, enforcing strong authentication for management interfaces, and segmenting PBX systems from the broader enterprise network to limit the impact of a potential breach. Regular vulnerability assessments and penetration testing can help identify and remediate similar weaknesses before they are exploited.

References

About Rescana

Rescana is a leader in third-party risk management (TPRM), providing organizations with a comprehensive platform to assess, monitor, and mitigate cyber risks across their supply chain and digital ecosystem. Our advanced threat intelligence and automation capabilities empower security teams to proactively identify vulnerabilities, respond to emerging threats, and ensure compliance with industry standards. For more information about how Rescana can help safeguard your organization, or if you have any questions regarding this advisory, please contact us at info@rescana.com.