Rishi on X: " Earlier today, I reported a critical vulnerability in the Issabel Framework (CVE ...

X • September 15, 2026

Rishi @rxerium 🚨 Earlier today, I reported a critical vulnerability in the Issabel Framework (CVE‑2026‑89026), rated CVSS 9.8 with early signs of exploitation in the wild. The vulnerability involves a hard-coded JWT signing key that allows unauthenticated attackers to forge tokens and ultimately achieve RCE on the underlying Asterisk system. It carries a CVSS score of 9.8 and has already been observed being exploited in the wild by The Shadowserver Foundation ( @ shadowserver ) as of 09/09. Thank you to @ VulnCheck for the smooth collaboration throughout the CNA process. More details: cve.org/CVERecord?id=C… 6:03 PM · Sep 15, 2026 4,922 Views 3

Simo @SimoKohonen 4h 💪💪💪 1

Xanagement @Xanagement 2h 😳

Anthony @HoustonIntrove1 3h A hard-coded JWT signing key is game over for auth—unauthenticated forge = admin if the app trusts the token. With CVSS 9.8 and early wild activity, I'd patch, rotate that key, and hunt sessions issued before the fix on any exposed Issabel.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerability in Issabel Framework Allows Remote Code Execution A severe vulnerability (CVE-2026-89026) in the Issabel Framework has been identified, allowing unauthenticated remote attackers to execute arbitrary OS commands. The flaw stems from a hard-coded JSON Web Token (JWT) signing key in the pbxapi/index.php file, which is identical across all installations. Exploitation began on September 9, 2026, as confirmed by the Shadowserver Foundation. A patch was released on August 1, 2026, but many systems remain unpatched. Users are urged to update to the latest version or restrict access to the vulnerable endpoint. The CVSS score for this vulnerability is 9.8, indicating critical severity. Organizations using Issabel Framework should take immediate action to mitigate risks. 5 sources 78

Extracted Entities

Rishi on X: " Earlier today, I reported a critical vulnerability in the Issabel Framework (CVE ...

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

Domains (1)

Platforms (2)

Vulnerabilities (1)