Risk Letters

Exploited vulnerability

CVE-2026-89026

TLP:CLEAR

Use of Hard-coded Cryptographic Key

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.

Facts

  • Vendor: Issabel Foundation
  • Product: Issabel Framework
  • EPSS (probability of exploitation within 30 days): 2.7 %
  • First known exploitation: 15 September 2026
  • First seen by Risk Letters: 15 September 2026

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD