{"id":2900,"date":"2026-09-16T16:31:08","date_gmt":"2026-09-16T16:31:08","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2900"},"modified":"2026-09-16T16:31:08","modified_gmt":"2026-09-16T16:31:08","slug":"attackers-exploit-issabel-framework-flaw-enabling-unauthenticated-os-command-execution","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2900","title":{"rendered":"Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 16, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A critical security flaw in Issabel Framework<\/a>, a web-based framework for the open-source unified communications PBX software, has come under active exploitation.<\/p>\n

The vulnerability in question is CVE-2026-89026<\/a><\/strong> (CVSS v3.1 score: 9.8\/CVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded JSON Web Token (JWT) signing key.<\/p>\n

The Issabel Framework \u00abcontains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens,\u00bb VulnCheck said<\/a> in an alert.<\/p>\n

\u00abAttackers can use the forged token to call the manager ‘\/pbxapi\/manager\/originate’ endpoint<\/a> with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

A patch for the vulnerability<\/a> was pushed on August 1, 2026, and plugs the flaw by replacing the hard-coded JWT key (\u00abda893kasdfam43k29akdkfaFFlsdfhj23rasdf\u00bb) with a JWT key stored in the \u00ab\/etc\/issabel.conf\u00bb file.<\/p>\n

According to the cybersecurity company, the Shadowserver Foundation first observed exploitation of CVE-2026-89026 on September 9, 2026. That said, there are currently no details on how the vulnerability is being abused in real-world attacks, who is behind them, and the scale of such efforts.<\/p>\n

Users of the Issabel Framework are advised to apply the latest fixes for optimal protection.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Sep 16, 2026Vulnerability \/ Web Security A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The…<\/p>\n","protected":false},"author":1,"featured_media":2901,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,1223,524,13,120,70,1931,3430,725],"class_list":["post-2900","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attackers","tag-command","tag-enabling","tag-execution","tag-exploit","tag-flaw","tag-framework","tag-issabel","tag-unauthenticated"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2900","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2900"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/2900\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/2901"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2900"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2900"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2900"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}