## What Happened
Shadowserver Foundation detected active in-the-wild exploitation of an Issabel PBX vulnerability on September 9, 2026. The attacks target telephony appliances to execute arbitrary operating system commands without authentication.
## Technical Details
- Vulnerability: CVE-2026-89026
- Severity scoring: CVSS 9.8 (CVSSv3)
- Product: Issabel Foundation Issabel Framework
- Root cause (as described): the framework API uses a hard-coded HS256 JWT signing key that is identical across installations, enabling unauthenticated JWT forgery.
- Attack flow:
- Forge valid JSON Web Tokens using the static HS256 key.
- Call the manager originate endpoint using the System application parameter.
- This results in Asterisk executing arbitrary system commands as the asterisk user.
- Patched in commit: b97dbaf0b71c1c36f841e672b664afbeb02773bd
## Affected
- Issabel Framework versions prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd
## Impact
- Remote code execution on the Issabel host via the PBX/telephony management interface.
- Potential for unauthenticated command execution leading to compromise and further pivoting into private enterprise networks.
## Mitigation
1. Update Issabel Framework immediately to include the fix from commit b97dbaf0b71c1c36f841e672b664afbeb02773bd.
2. Ensure the deployment uses the patched behavior that generates unique signing keys per installation.
3. Restrict web management access using strict network firewall rules (limit exposure to trusted networks only).