Remote Code Execution Vulnerability in Issabel PBX Software
CVE-2026-89026

9.3CRITICAL

Key Information:

Vendor: Issabel Foundation
Status: Issabel Framework
Vendor: CVE Published:; 15 September 2026

🔔 Create Issabel Foundation Vulnerability Alert

Badges

📈 Trended📈 Score: 1,930👾 Exploit Exists📰 News Worthy

What is CVE-2026-89026?

CVE-2026-89026 is a severe vulnerability found in the Issabel PBX software, which is a popular open-source solution used for managing communications within organizations. The vulnerability arises from a security flaw in the Issabel Framework, specifically in the pbxapi index.php file, where a hard-coded HS256 JWT signing key is present. This signing key is consistent across all installations, allowing unauthorized remote attackers to forge valid bearer tokens easily. By exploiting this vulnerability, attackers can authenticate without proper authorization and make calls to the manager originate endpoint. This compromise enables them to execute arbitrary operating system commands on the server as the Asterisk user, putting organizations at substantial risk of control and disruption.

Potential impact of CVE-2026-89026

Unauthorized Remote Access: The primary impact of this vulnerability is the possibility for unauthorized users to gain remote access to the affected Issabel PBX systems. By forging valid tokens, attackers can perform actions that should be restricted to authenticated users, leading to significant security breaches.
Arbitrary Code Execution: Successful exploitation allows attackers to execute arbitrary commands on the underlying operating system as the Asterisk user. This capability can lead to substantial system compromises, including the installation of malware, data theft, or complete system takeover.
Service Disruption and Data Loss: Given the critical nature of PBX systems in organizational communications, the exploitation of this vulnerability can result in disrupted services and potential data loss. Attackers could manipulate communication flows, which may affect business operations and stakeholder trust.

Affected Version(s)

Issabel Framework 0

News Articles

Webpronews

CVE-2026-89026

Hard-Coded JWT Secret in Issabel PBX Opens Door to Unauthenticated Server Takeover

Attackers are exploiting CVE-2026-89026 in the Issabel Framework by forging JWT tokens with a hard-coded secret, achieving unauthenticated RCE on PBX systems via Asterisk. Shadowserver detected activity on Sept. 9. Administrators must patch immediately to the August 1 commit.