Issabel Framework, the web core of the open source PBX platform, is at the center of a critical advisory. The vulnerability, CVE-2026-89026, allows remote, unauthenticated attackers to spoof access tokens and cause Asterisk to execute commands.
The Issabel Framework is used to manage Issabel PBX installations and this vulnerability does not require an account or user interaction. The issue received a CVSS 3.1 score of 9.8 and a CVSS 4.0 score of 9.3, which places it in the critical category.
The attack is particularly dangerous for organizations that expose their phone system to remote management. A compromised PBX is not just about calls: it can expose logs, routing settings, SIP details, voicemail, and customer data. It can also be used as an entry point into other parts of the network.
See also: Critical vulnerability in WSO2 API Manager actively exploited
How the Issabel Framework vulnerability works
According to The Hacker News, the pbxapi/index.php contained a hard-coded HS256 key for JSON Web Tokens. The same key existed on every installation, effectively nullifying the promise that a valid token is only generated by that particular server.
Knowing the key, an attacker can construct a fake bearer token without real credentials. The token can then be used on the /pbxapi/manager/originate with the System. Asterisk then executes operating system commands with the privileges of the Asterisk user, paving the way for data theft, telephony configuration changes, or malware installation.
CVE -2026-89026 is not just a theoretical problem. The Shadowserver Foundation first noticed signs of exploitation on September 9, 2026, before the related logs were published. No details have been released regarding the identity of the perpetrators, the extent of the activity, or specific public exploit code.
What does the Issabel Framework fix?
The GitHub Advisory Database entry states that versions prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. The fix removes the shared secret from the code and uses a key stored in /etc/issabel.confso that each installation has different signing material.
Administrators should not be satisfied with a version check that the admin interface displays. They need to verify that the patched framework is installed on the live PBX and that pbxapi/index.php no longer contains the static key. Tenable's technical documentation confirms the same patch commit threshold.
Rekeying should not be considered a sole remediation step. If a system was exposed before the patch was installed, security administrators should consider the possibility of issuing fake tokens and review the actions taken with them. Particular attention should be paid to unexpected commands initiated by the Asterisk service.
See also: WebSocket vulnerability allows module injection
Immediate actions for administrators
Until the upgrade is complete, Issabel's web environment and pbxapi endpoints should be restricted with firewall rules, whitelists, or VPNs. Exposure to the public internet significantly increases the risk, especially when the telephony infrastructure is connected to other internal systems.
At the same time, the SecNews technical team recommends checking web-server and Asterisk logs for unusual bearer tokens, unexpected calls to manager/originate, use of the System, new processes and unexpected outbound connections. In case of suspicious activity, it is necessary to preserve the data, change credentials and check the systems that communicate with the PBX.
See also: Playwright WebSocket vulnerability exposes files
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Isolating the management interface helps, but is not a substitute for installing the official fix. After upgrading, organizations need to verify that the new key was generated per installation, renew credentials that may have been exposed, and monitor the PBX for unusual behavior.
It is also useful to list Issabel installations that are accessible from the internet and check if they are using the same framework version. Temporarily disabling non-essential APIs, sending logs to an independent system, and comparing recent configuration changes can reduce detection time. These actions should be included in the incident response plan.
Issabel Framework needs to be updated immediately on every installation that is accessible from the internet. Because CVE-2026-89026 combines authentication bypass with command execution and a previously observed exploit, the update should be accompanied by a check for a previous breach and not treated as a standard update.
