Issabel Pbx Hard Coded Jwt Key Rce Via Pbxapi Manager Originate

Back www.vulncheck.com

Issabel Pbx Hard Coded Jwt Key Rce Via Pbxapi Manager Originate

www.vulncheck.com • September 16, 2026

Share: View original

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical CVE-2026-89026 in Issabel Framework Under Active Exploitation A severe vulnerability (CVE-2026-89026) in the Issabel Framework has been discovered, allowing unauthenticated remote attackers to execute arbitrary OS commands. This flaw stems from a hard-coded JSON Web Token (JWT) signing key, which can be exploited to forge valid bearer tokens. The vulnerability has a CVSS score of 9.8, indicating its critical nature. Active exploitation was first observed by the Shadowserver Foundation on September 9, 2026. A patch was released on August 1, 2026, to mitigate the issue by replacing the hard-coded key. Users of the Issabel Framework are urged to apply the patch immediately to prevent potential attacks. Details on the scale of exploitation or the attackers remain unclear. The vulnerability affects all installations of the Issabel Framework due to the identical hard-coded key. 2 sources 78

Extracted Entities

Attack Types (1)

Remote Code Execution

CWE Weaknesses (1)

CWE-798 - Use of Hard-coded Credentials

Platforms (2)

Issabel Pbx Pbxapi Manager