Threat Intelligence

Critical Issabel PBX Flaw Under Active Attack: Hard-Coded Key Lets Hackers Run Commands

The Hacker News · 17 Sept 2026

Key Takeaway If your business uses Issabel Framework for phone or communications systems, patch immediately, as attackers are actively exploiting this flaw to gain unauthorised control.

A serious security flaw in Issabel Framework, a widely used open-source PBX communications platform, is now being exploited by attackers in the wild. Tracked as CVE-2026-89026 and rated critical (CVSS 9.8), the vulnerability stems from a hard-coded JWT signing key found in every Issabel installation. Because this key is identical across all deployments, attackers can forge valid authentication tokens without needing a username or password.

Once an attacker has a forged token, they can call a specific management function within Issabel that lets Asterisk (the underlying phone system software) execute operating system commands. This means an attacker could potentially take control of the server without ever logging in. Security researchers at VulnCheck flagged the issue, and the Shadowserver Foundation reported observing active exploitation attempts starting September 9, 2026. Details on the scale or identity of the attackers behind these attempts have not yet been disclosed.

Issabel released a patch on August 1, 2026, replacing the hard-coded key with one uniquely generated and stored in a configuration file on each system. Organisations still running unpatched versions remain exposed to this flaw and should treat it as an urgent priority.

Issabel vulnerability PBX security unauthenticated exploit patch management

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.