Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

1. Executive summary

Attackers are actively exploiting CVE-2026-89026 (CVSS 9.3, Critical; CWE-321, Use of Hard-coded Cryptographic Key) in Issabel Framework, the web framework for the open-source Issabel unified-communications PBX. The flaw is a hard-coded HS256 JWT signing key in pbxapi/index.php that is identical on every installation, allowing an unauthenticated remote attacker to forge a valid bearer token and call the /pbxapi/manager/originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. The Shadowserver Foundation first observed exploitation on 9 September 2026; a vendor patch shipped on 1 August 2026. The CVE is not in CISA KEV and EPSS is 1%, so exploitation volume is likely low and targeted rather than opportunistic — but any EMEA financial services firm running an internet-facing Issabel PBX should treat this as an emergency patch. No threat actor has been attributed.

2. Regulatory framing

No DORA article is directly engaged by this item as issued: there is no confirmed incident in a client estate, no named ICT third-party provider contract, and no concentration finding. If exploitation of CVE-2026-89026 is confirmed against a client's own Issabel instance, DORA Art. 17 (ICT-related incident management process), Art. 18 (classification of ICT-related incidents and cyber threats) and Art. 19 (reporting of major ICT-related incidents to competent authorities), and NIS2 Art. 23 (incident reporting obligations), become engaged at that point.

3. Technical analysis & attack chain

Affected component: Issabel Framework — the web-based framework layer for the open-source Issabel unified-communications PBX (Asterisk-based). The source material does not state affected version numbers or a version range; treat any pre-1-August-2026 build with an exposed pbxapi endpoint as potentially vulnerable until verified.

Confirmed attack chain

1. The attacker obtains the HS256 JWT signing key. No access to the target is required to know it: the key is hard-coded in the pbxapi/index.php file and is identical across every installation.
2. The attacker forges a valid bearer JWT signed with that key.
3. The attacker presents the forged token to the manager endpoint /pbxapi/manager/originate, supplying the System application parameter.
4. Asterisk processes the originate request and executes arbitrary operating system commands as the Asterisk user — unauthenticated remote code execution on the PBX host.

Vulnerability mechanism: CWE-321 (Use of Hard-coded Cryptographic Key). The signing key da893kasdfam43k29akdkfaFFlsdfhj23rasdf was embedded in pbxapi/index.php and shared by all deployments, so token forgery requires no secret extraction — only knowledge of the public source. The verified reference data classifies this as CWE-321, consistent with the source's description of a hard-coded JWT signing key; no classification discrepancy.

Vendor fix: A patch was pushed on 1 August 2026. It removes the hard-coded key and replaces it with a JWT key stored in /etc/issabel.conf. Note that the fix relocates the secret rather than merely rotating it — post-patch, the key must be unique per installation and the file permissions on /etc/issabel.conf become security-relevant.

Exploitation timeline: Shadowserver first observed exploitation of CVE-2026-89026 on 9 September 2026 — approximately five weeks after the patch was published, indicating exploitation of unpatched, internet-facing instances.

Not established by the source material: payload or malware capabilities, persistence mechanism, privilege escalation beyond the Asterisk user context, command-and-control, lateral movement, data access or exfiltration, and the identity, motivation or scale of the actors. The source explicitly states there are currently no details on how the vulnerability is being abused in real-world attacks, who is behind them, or the scale of such efforts. Do not assume a reverse shell, webshell or extortion component — none is described.

Confidence caveat: All technical detail above (the key value, the pbxapi/index.php location, the /pbxapi/manager/originate endpoint and System parameter, the /etc/issabel.conf fix, and the 1 August 2026 patch date) traces to a single vendor alert (VulnCheck) relayed by The Hacker News. The 9 September 2026 first-observation date is attributed to the Shadowserver Foundation via the same relay. Single-sourced; verify against the vendor advisory and your own telemetry before acting on the specifics.

Related but separate activity: A second, distinct VoIP/UC exploitation item in the same reporting window concerns CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (build 104997) reported to allow remote code execution and reverse-shell deployment. That CVE is not covered by the verified reference data supplied with this advisory, is a different product and a different vulnerability class, and is single-sourced. It is noted only as context for a possible targeting trend against internet-facing UC infrastructure; do not conflate the two CVEs or their mitigations.

4. Mitigation & containment

P1 — within 24 hours

1. Inventory exposure. Identify all Issabel Framework deployments, and specifically any pbxapi endpoint reachable from the internet. Grep the web root for the hard-coded key to confirm vulnerable builds: grep -r "da893kasdfam43k29akdkfaFFlsdfhj23rasdf" /var/www/html/pbxapi/ (adjust path to your deployment).
2. Contain if unpatched and internet-facing. Block external access to /pbxapi/ at the WAF or reverse proxy, or take the endpoint offline entirely, until the patch is applied. Restrict pbxapi to management networks only.
3. Hunt for exploitation. Search HTTP/reverse-proxy logs for POST requests to /pbxapi/manager/originate, particularly with a System application parameter, and for bearer tokens signed with the hard-coded key. On the PBX host, look for the Asterisk process spawning shells or OS commands as the asterisk user.
4. Assume compromise where the endpoint was exposed and unpatched. Treat any such instance as potentially compromised and preserve logs before remediation.

P2 — within 72 hours

5. Apply the 1 August 2026 vendor patch to every Issabel Framework instance. After patching, verify the hard-coded key is gone from pbxapi/index.php and that the JWT key now resides in /etc/issabel.conf.
6. Set a unique key per installation and lock down /etc/issabel.conf permissions (readable only by the service account) — the patch relocates the secret, so a shared or world-readable file reintroduces the same class of weakness.
7. Rotate credentials and review Asterisk configuration for unauthorised dialplan entries, outbound routes, or originate/manager configuration changes that would indicate post-exploitation persistence.

P3 — within 7 days

8. Segment the PBX from corporate networks and apply egress filtering — a PBX has no legitimate need to initiate arbitrary outbound connections, which limits the value of any code execution achieved as the Asterisk user.
9. Add the §6 detections to web-log and process-telemetry pipelines, and re-scan the estate for the hard-coded key string on a recurring basis.
10. Review the wider UC estate. Given the concurrent Switchvox reporting, confirm whether any Sangoma Switchvox SMB Edition 8.3 (104997) instances are internet-facing and assess them separately against CVE-2026-9586.

There is no CISA KEV entry for CVE-2026-89026 and therefore no federal remediation due date; the 24-hour P1 window above is Adverse Trace's recommendation based on confirmed active exploitation, not a regulatory deadline.

5. Indicators of compromise

No attacker-controlled atomic indicators (hashes, domains, IP addresses, malware filenames) appear in the source material. The atomic strings below are artefacts of the vulnerable component and are useful for exposure hunting, not for attributing an intrusion.

string  da893kasdfam43k29akdkfaFFlsdfhj23rasdf
uri_path  /pbxapi/manager/originate
file_path  pbxapi/index.php
file_path  /etc/issabel.conf

Behavioural indicators

6. Detection

rule Issabel_PBXAPI_Hardcoded_JWT_Key_CVE_2026_89026
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-16"
        reference = "https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html"
        description = "Detects the hard-coded HS256 JWT signing key and the abused manager originate endpoint associated with CVE-2026-89026 in Issabel Framework pbxapi/index.php"
    strings:
        $key = "da893kasdfam43k29akdkfaFFlsdfhj23rasdf" ascii
        $ep  = "/pbxapi/manager/originate" ascii
    condition:
        any of them
}

title: Issabel PBXAPI Originate Endpoint Abuse (CVE-2026-89026)
id: 8f2c1a44-7b90-4d2e-9c11-at20260916
status: experimental
description: Detects unauthenticated requests to the Issabel Framework manager originate endpoint used to trigger OS command execution as the Asterisk user via a forged JWT.
references:

  - https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html
author: Adverse Trace
date: 2026/09/16
logsource:
  category: webserver
detection:
  selection:
    cs-method: 'POST'
    cs-uri-stem|contains: '/pbxapi/manager/originate'
  condition: selection
falsepositives:

  - Legitimate administrative use of the PBXAPI originate endpoint
level: high

title: Asterisk Process Spawning Shell (Issabel PBXAPI Command Execution)
id: 3d7e5b21-9a04-4f88-b6c2-at20260916
status: experimental
description: Detects the Asterisk process spawning a shell, consistent with OS command execution as the Asterisk user following abuse of the Issabel PBXAPI originate endpoint.
references:

  - https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html
author: Adverse Trace
date: 2026/09/16
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|endswith: '/asterisk'
    Image|endswith:

      - '/sh'
      - '/bash'
      - '/dash'
  condition: selection
falsepositives:

  - Legitimate Asterisk AGI scripts and system() dialplan calls
level: high

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News — "Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution" — https://thehackernews.com/2026/09/attackers-exploit-issabel-framework.html — 2026-09-16 (primary item; relays a VulnCheck alert and a Shadowserver Foundation observation)
• The Hacker News — "Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials" — https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html — publication date not stated in the supplied material (related, separate CVE-2026-9586)

8. Adverse Trace position

CVE-2026-89026 is rated 9.3 Critical in our verified reference data (the source quotes CVSS v3.1 9.8 alongside v4.0 9.3; we use the verified 9.3). It is not in CISA KEV and carries an EPSS of 1% — a low predicted exploitation probability that sits in tension with Shadowserver's confirmed observation of exploitation on 9 September 2026; EPSS is a forward-looking probability estimate and does not override a confirmed in-the-wild sighting. The practical risk is narrow but severe: unauthenticated, pre-auth RCE as the Asterisk user against any internet-facing, unpatched Issabel PBX, with no credential or user interaction required. No actor has been attributed and no MITRE ATT&CK profile applies — attribution is unconfirmed and should not be inferred. The technical specifics rest on a single vendor alert relayed by one outlet; verify the key value, endpoint and patch details against the vendor advisory before enforcing blocks or writing them into production detections. Adverse Trace will monitor for a CISA KEV addition, for any named-actor attribution, and for post-exploitation tradecraft (persistence, C2, exfiltration) that the current reporting does not describe, and will reissue this advisory if the exploitation picture changes.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.