CVE-2026-89026

This vulnerability is like a master key that comes pre-printed in the building—anyone who finds it can pretend to be the right person. In Issabel Framework, that lets an attacker send a request that makes the phone server run arbitrary commands on the underlying computer. For a small business, that means the attacker may be able to damage systems, install malware, or disrupt phone service.

This matters if you run Issabel Framework for your Issabel PBX/phone system, and your version is prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. The findings indicate no authentication or user action is required, and it is reachable in default configuration—so exposure is primarily about whether your server is reachable over the network from the internet.
Only treat it as a risk if the affected Issabel Framework web/API endpoints are reachable from outside your network (not blocked by firewall/VPN) and you are on a vulnerable version.

This is RED because exploitation is actively being reported in the wild, including unauthenticated remote OS command execution. Attackers do not need credentials or user interaction, and the default setup can leave the vulnerable endpoints reachable over the network—so you should act immediately to remove the vulnerable version and block direct internet access to the exposed interfaces.

1. Confirm exposure (version check)

   • Determine the exact Issabel Framework version/commit you are running.
   • If it is prior to b97dbaf0b71c1c36f841e672b664afbeb02773bd, you are considered vulnerable based on the findings.

2. Confirm the target surface (internet reachability)

   • From the outside, verify whether the Issabel Framework web/API endpoints are reachable directly (e.g., open HTTP/HTTPS to the server).
   • If your endpoints are not publicly reachable (only accessible via VPN/internal network), the risk is reduced—but the vulnerability still warrants patching.

3. Upgrade to the fixed version

   • Upgrade Issabel Framework to fixed in b97dbaf0b71c1c36f841e672b664afbeb02773bd.
   • After upgrade, re-check the installed commit/version to ensure the change actually took effect.

4. If you must delay patching (temporary containment)

   • Block inbound access from the open internet to the Issabel Framework web/API endpoints.
   • Allow only trusted sources (e.g., your admin network/VPN).

5. Hunt/monitor after remediation

   • Review logs for suspicious calls related to pbxapi/manager/originate.
   • Look for signs of unexpected OS command execution or abnormal Asterisk/host activity around the time of any suspicious requests.

CISA due date: Not provided (not listed in CISA KEV for this CVE in the findings).

Severity is critical (CVSS 9.8) with remote, no-credentials, no-interaction impact. The weakness is CWE-321 (hard-coded cryptographic key). Mechanism: Issabel Framework before commit b97dbaf contains a hard-coded HS256 JWT signing key in pbxapi index.php that is identical across installations. Attackers can forge valid bearer JWTs without knowing a per-installation secret, then use the forged token to access the manager originate endpoint (System application parameter), which leads to arbitrary OS command execution as the Asterisk user.

Exploitation status: Active exploitation is reported by news/press findings, and exploitation evidence is described as observed by Shadowserver Foundation (first observed 2026-09-09). No public exploit code is on record, but exploitation being reported elevates real-world risk above prediction-based scoring.

KEV: Not listed in CISA KEV (per findings). EPSS: a low predicted likelihood is noted, but it should not outweigh the confirmed active exploitation in the findings.