> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution - URL: https://f4n6.co.uk/security-feed/attackers-exploit-issabel-framework-flaw-enabling-unauthenticated-os-command-execution/ - Published: 2026-09-16T20:47:08.000Z - Updated: 2026-09-16T20:47:08.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-89026 ## 1\. Executive summary Attackers are actively exploiting CVE-2026-89026 (CVSS 9.3, **Critical**; CWE-321, Use of Hard-coded Cryptographic Key) in Issabel Framework, the web framework for the open-source Issabel unified-communications PBX. The flaw is a hard-coded HS256 JWT signing key in `pbxapi/index.php` that is identical on every installation, allowing an unauthenticated remote attacker to forge a valid bearer token and call the `/pbxapi/manager/originate` endpoint with the `System` application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. The Shadowserver Foundation first observed exploitation on 9 September 2026; a vendor patch shipped on 1 August 2026\. The CVE is **not** in CISA KEV and EPSS is 1%, so exploitation volume is likely low and targeted rather than opportunistic — but any EMEA financial services firm running an internet-facing Issabel PBX should treat this as an emergency patch. No threat actor has been attributed. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | -------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | NIS2 Art. 21(2)(d): supply chain security measures | The vulnerability is a hard-coded HS256 JWT signing key that is *identical across every installation* of Issabel Framework — a component-level integrity failure shipped by the supplier, not a per-customer misconfiguration | In-scope entities must treat component and supplier security as a managed measure: inventory Issabel deployments, confirm the patched build is deployed, and retain evidence of the supplier's fix timeline and assurance for the component | No DORA article is directly engaged by this item as issued: there is no confirmed incident in a client estate, no named ICT third-party provider contract, and no concentration finding. If exploitation of CVE-2026-89026 is confirmed against a client's own Issabel instance, DORA Art. 17 (ICT-related incident management process), Art. 18 (classification of ICT-related incidents and cyber threats) and Art. 19 (reporting of major ICT-related incidents to competent authorities), and NIS2 Art. 23 (incident reporting obligations), become engaged at that point. ## 3\. Technical analysis & attack chain **Affected component:** Issabel Framework — the web-based framework layer for the open-source Issabel unified-communications PBX (Asterisk-based). The source material does **not** state affected version numbers or a version range; treat any pre-1-August-2026 build with an exposed `pbxapi` endpoint as potentially vulnerable until verified. ### Confirmed attack chain 1. The attacker obtains the HS256 JWT signing key. No access to the target is required to know it: the key is hard-coded in the `pbxapi/index.php` file and is identical across every installation. 2. The attacker forges a valid bearer JWT signed with that key. 3. The attacker presents the forged token to the manager endpoint `/pbxapi/manager/originate`, supplying the `System` application parameter. 4. Asterisk processes the originate request and executes arbitrary operating system commands **as the Asterisk user** — unauthenticated remote code execution on the PBX host. **Vulnerability mechanism:** CWE-321 (Use of Hard-coded Cryptographic Key). The signing key `da893kasdfam43k29akdkfaFFlsdfhj23rasdf` was embedded in `pbxapi/index.php` and shared by all deployments, so token forgery requires no secret extraction — only knowledge of the public source. The verified reference data classifies this as CWE-321, consistent with the source's description of a hard-coded JWT signing key; no classification discrepancy. **Vendor fix:** A patch was pushed on 1 August 2026\. It removes the hard-coded key and replaces it with a JWT key stored in `/etc/issabel.conf`. Note that the fix relocates the secret rather than merely rotating it — post-patch, the key must be unique per installation and the file permissions on `/etc/issabel.conf` become security-relevant. **Exploitation timeline:** Shadowserver first observed exploitation of CVE-2026-89026 on 9 September 2026 — approximately five weeks after the patch was published, indicating exploitation of unpatched, internet-facing instances. **Not established by the source material:** payload or malware capabilities, persistence mechanism, privilege escalation beyond the Asterisk user context, command-and-control, lateral movement, data access or exfiltration, and the identity, motivation or scale of the actors. The source explicitly states there are currently no details on how the vulnerability is being abused in real-world attacks, who is behind them, or the scale of such efforts. Do not assume a reverse shell, webshell or extortion component — none is described. ### Confidence caveat: **All technical detail above (the key value, the `pbxapi/index.php` location, the `/pbxapi/manager/originate` endpoint and `System` parameter, the `/etc/issabel.conf` fix, and the 1 August 2026 patch date) traces to a single vendor alert (VulnCheck) relayed by The Hacker News. The 9 September 2026 first-observation date is attributed to the Shadowserver Foundation via the same relay.** Single-sourced; verify against the vendor advisory and your own telemetry before acting on the specifics. **Related but separate activity:** A second, distinct VoIP/UC exploitation item in the same reporting window concerns CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) reported to allow remote code execution and reverse-shell deployment. That CVE is **not** covered by the verified reference data supplied with this advisory, is a different product and a different vulnerability class, and is single-sourced. It is noted only as context for a possible targeting trend against internet-facing UC infrastructure; do not conflate the two CVEs or their mitigations. ## 4\. Mitigation & containment ### P1 — within 24 hours 1. **Inventory exposure.** Identify all Issabel Framework deployments, and specifically any `pbxapi` endpoint reachable from the internet. Grep the web root for the hard-coded key to confirm vulnerable builds: `grep -r "da893kasdfam43k29akdkfaFFlsdfhj23rasdf" /var/www/html/pbxapi/` (adjust path to your deployment). 2. **Contain if unpatched and internet-facing.** Block external access to `/pbxapi/` at the WAF or reverse proxy, or take the endpoint offline entirely, until the patch is applied. Restrict `pbxapi` to management networks only. 3. **Hunt for exploitation.** Search HTTP/reverse-proxy logs for `POST` requests to `/pbxapi/manager/originate`, particularly with a `System` application parameter, and for bearer tokens signed with the hard-coded key. On the PBX host, look for the Asterisk process spawning shells or OS commands as the `asterisk` user. 4. **Assume compromise where the endpoint was exposed and unpatched.** Treat any such instance as potentially compromised and preserve logs before remediation. ### P2 — within 72 hours 1. **Apply the 1 August 2026 vendor patch** to every Issabel Framework instance. After patching, verify the hard-coded key is gone from `pbxapi/index.php` and that the JWT key now resides in `/etc/issabel.conf`. 2. **Set a unique key per installation** and lock down `/etc/issabel.conf` permissions (readable only by the service account) — the patch relocates the secret, so a shared or world-readable file reintroduces the same class of weakness. 3. **Rotate credentials and review Asterisk configuration** for unauthorised dialplan entries, outbound routes, or originate/manager configuration changes that would indicate post-exploitation persistence. ### P3 — within 7 days 1. **Segment the PBX** from corporate networks and apply egress filtering — a PBX has no legitimate need to initiate arbitrary outbound connections, which limits the value of any code execution achieved as the Asterisk user. 2. **Add the §6 detections** to web-log and process-telemetry pipelines, and re-scan the estate for the hard-coded key string on a recurring basis. 3. **Review the wider UC estate.** Given the concurrent Switchvox reporting, confirm whether any Sangoma Switchvox SMB Edition 8.3 (104997) instances are internet-facing and assess them separately against CVE-2026-9586. There is **no CISA KEV entry** for CVE-2026-89026 and therefore no federal remediation due date; the 24-hour P1 window above is Adverse Trace's recommendation based on confirmed active exploitation, not a regulatory deadline. ## 5\. Indicators of compromise No attacker-controlled atomic indicators (hashes, domains, IP addresses, malware filenames) appear in the source material. The atomic strings below are artefacts of the vulnerable component and are useful for exposure hunting, not for attributing an intrusion. | type | value | confidence | source | | ----------------------------------------- | -------------------------------------- | ---------- | -------------------------------------------- | | string (hard-coded HS256 JWT signing key) | da893kasdfam43k29akdkfaFFlsdfhj23rasdf | high | The Hacker News / VulnCheck (single-sourced) | | uri\_path (abused manager endpoint) | /pbxapi/manager/originate | high | The Hacker News / VulnCheck (single-sourced) | | file\_path (vulnerable file) | pbxapi/index.php | high | The Hacker News / VulnCheck (single-sourced) | | file\_path (post-patch key location) | /etc/issabel.conf | high | The Hacker News / VulnCheck (single-sourced) | ```iocs string da893kasdfam43k29akdkfaFFlsdfhj23rasdf uri_path /pbxapi/manager/originate file_path pbxapi/index.php file_path /etc/issabel.conf ``` ### Behavioural indicators | behaviour | where to observe | confidence | | -------------------------------------------------------------------------------------- | ------------------------------------------------ | ---------------------------------------------------------------------------------------------- | | POST to /pbxapi/manager/originate carrying a System application parameter | PBX HTTP logs, reverse-proxy/WAF logs | high (single-sourced) | | Bearer JWT signed with the hard-coded HS256 key da893kasdfam43k29akdkfaFFlsdfhj23rasdf | HTTP logs, token inspection at the proxy | high (single-sourced) | | Asterisk process spawning a shell or OS command as the asterisk user | EDR / process-creation telemetry on the PBX host | medium (inferred from the described command-execution impact; no command line given in source) | | Presence of the hard-coded key string in pbxapi/index.php | File-integrity monitoring, configuration scan | high (single-sourced) | ## 6\. Detection ```yara rule Issabel_PBXAPI_Hardcoded_JWT_Key_CVE_2026_89026 { meta: author = "Adverse Trace" date = "2026-09-16" reference = "https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html" description = "Detects the hard-coded HS256 JWT signing key and the abused manager originate endpoint associated with CVE-2026-89026 in Issabel Framework pbxapi/index.php" strings: $key = "da893kasdfam43k29akdkfaFFlsdfhj23rasdf" ascii $ep = "/pbxapi/manager/originate" ascii condition: any of them } ``` ```yaml title: Issabel PBXAPI Originate Endpoint Abuse (CVE-2026-89026) id: 8f2c1a44-7b90-4d2e-9c11-at20260916 status: experimental description: Detects unauthenticated requests to the Issabel Framework manager originate endpoint used to trigger OS command execution as the Asterisk user via a forged JWT. references: - https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html author: Adverse Trace date: 2026/09/16 logsource: category: webserver detection: selection: cs-method: 'POST' cs-uri-stem|contains: '/pbxapi/manager/originate' condition: selection falsepositives: - Legitimate administrative use of the PBXAPI originate endpoint level: high ``` ```yaml title: Asterisk Process Spawning Shell (Issabel PBXAPI Command Execution) id: 3d7e5b21-9a04-4f88-b6c2-at20260916 status: experimental description: Detects the Asterisk process spawning a shell, consistent with OS command execution as the Asterisk user following abuse of the Issabel PBXAPI originate endpoint. references: - https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html author: Adverse Trace date: 2026/09/16 logsource: category: process_creation product: linux detection: selection: ParentImage|endswith: '/asterisk' Image|endswith: - '/sh' - '/bash' - '/dash' condition: selection falsepositives: - Legitimate Asterisk AGI scripts and system() dialplan calls level: high ``` ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | -------------------------------------------------------------------------------- | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-89026](https://nvd.nist.gov/vuln/detail/CVE-2026-89026?ref=f4n6.co.uk) | 9.3 Critical | — | 1% | The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT… | ## 7\. Sources - The Hacker News — "Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution" — https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html — 2026-09-16 (primary item; relays a VulnCheck alert and a Shadowserver Foundation observation) - The Hacker News — "Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials" — https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html — publication date not stated in the supplied material (related, separate CVE-2026-9586) ## 8\. Adverse Trace position CVE-2026-89026 is rated **9.3 Critical** in our verified reference data (the source quotes CVSS v3.1 9.8 alongside v4.0 9.3; we use the verified 9.3). It is **not** in CISA KEV and carries an EPSS of 1% — a low predicted exploitation probability that sits in tension with Shadowserver's confirmed observation of exploitation on 9 September 2026; EPSS is a forward-looking probability estimate and does not override a confirmed in-the-wild sighting. The practical risk is narrow but severe: unauthenticated, pre-auth RCE as the Asterisk user against any internet-facing, unpatched Issabel PBX, with no credential or user interaction required. No actor has been attributed and no MITRE ATT&CK profile applies — attribution is unconfirmed and should not be inferred. The technical specifics rest on a single vendor alert relayed by one outlet; verify the key value, endpoint and patch details against the vendor advisory before enforcing blocks or writing them into production detections. Adverse Trace will monitor for a CISA KEV addition, for any named-actor attribution, and for post-exploitation tradecraft (persistence, C2, exfiltration) that the current reporting does not describe, and will reissue this advisory if the exploitation picture changes. --- [Read the original source →](https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*