A critical security flaw impacting the **Issabel Framework**, the web-based backbone for the open-source unified communications PBX software, has come under active exploitation. The vulnerability, identified as **CVE-2026-89026**, carries a high CVSS v3.1 score of 9.8 (and CVSS v4.0 score of 9.3). This flaw enables an unauthenticated remote attacker to execute arbitrary operating system (OS) commands. ### The Root Cause: Hard-Coded JWT Signing Key According to **VulnCheck**, the **Issabel Framework** contains a hard-coded HS256 JWT signing key within the `pbxapi index.php` file. This key is identical across all installations, allowing attackers to forge valid bearer tokens. "Attackers can use the forged token to call the manager `/pbxapi/manager/originate` endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user," **VulnCheck** explained in an advisory. ### Patch and Exploitation Timeline A patch for **CVE-2026-89026** was released on August 1, 2026. This fix addresses the vulnerability by replacing the static JWT key (which was previously `da893kasdfam43k29akdkfaFFlsdfhj23rasdf`) with a dynamically generated key stored in the `/etc/issabel.conf` file.  **The Shadowserver Foundation** first observed active exploitation of **CVE-2026-89026** on September 9, 2026. While exploitation is confirmed, specific details regarding the nature of these attacks, the threat actors involved, or the overall scale remain undisclosed. ### Recommendation for Users Users of the **Issabel Framework** are strongly advised to apply the latest available patches immediately to mitigate the risk posed by this critical vulnerability and ensure optimal security.