Critical Issabel PBX Vulnerability (CVE-2026-89026) Actively Exploited in the Wild A critical vulnerability in the Issabel Framework, which powers Issabel PBX deployments, is under active exploitation. Tracked as CVE-2026-89026 (CVSS v4: 9.3), the flaw allows unauthenticated remote attackers to execute arbitrary OS commands on vulnerable servers by forging authentication tokens. The vulnerability stems from a hard-coded HS256 JSON Web Token (JWT) signing key embedded in the `pbxapi/index.php` file, present across affected installations. Attackers can generate a malicious bearer token, bypassing authentication, and submit requests to exposed API endpoints specifically the `pbxapi/manager/originate` endpoint, which interacts with the Asterisk Manager Interface. This enables command execution under the Asterisk service account, potentially leading to malware deployment, data theft, or lateral movement within a network. Exploitation was first observed by the Shadowserver Foundation on September 9, 2026, targeting internet-exposed Issabel PBX systems. The flaw (CWE-321) poses a severe risk due to its low attack complexity, requiring no user interaction or prior access. Affected versions include Issabel Framework releases before commit `b97dbaf0b71c1c36f841e672b664afbeb02773bd`. Organizations are advised to patch immediately, verify the removal of the hard-coded key, and restrict access to PBX administration interfaces. Security teams should monitor logs for suspicious token activity, unusual `originate` requests, or unauthorized command execution. VulnCheck has added the vulnerability to its Known Exploited Vulnerabilities database, emphasizing the urgency of remediation.