Critical Issabel Framework Flaw Under Active Exploitation: CVE-2026-89026
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- issabel (npm)
- Patched version
- Not yet available
An early warning has been issued regarding a critical security flaw in the Issabel Framework, which is reportedly under active exploitation. Users of the Issabel Framework are advised to take immediate action.
What happened
A critical security flaw in the Issabel Framework, identified as CVE-2026-89026, has come under active exploitation. The vulnerability allows an unauthenticated remote attacker to execute arbitrary operating system commands by exploiting a hard-coded JSON Web Token (JWT) signing key. This key is present in the pbxapi index.php file and is identical across every installation, enabling attackers to forge valid bearer tokens. These tokens can then be used to call specific endpoints, resulting in the execution of arbitrary OS commands as the Asterisk user.
The flaw was patched on August 1, 2026, by replacing the hard-coded JWT key with one stored in the /etc/issabel.conf file. The Shadowserver Foundation first observed exploitation of this vulnerability on September 9, 2026. However, details on the real-world abuse of this vulnerability, including the attackers and the scale of the efforts, remain unknown.
What to do about it
- Upgrade to the latest version of the Issabel Framework immediately.
- Monitor your systems for any suspicious activity that may indicate exploitation of CVE-2026-89026.
- Consult the primary sources for the most current information and patches.
- No official fix has been published yet for specific version ranges. Monitor the sources below for updates.
How 0Day would have caught this
issabel is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using the Issabel Framework, you may be affected. No authoritative version range has been published yet.
What should I do right now?
Upgrade to the latest version of the Issabel Framework and monitor your systems for any suspicious activity.
Has this been exploited in the wild?
Yes, the vulnerability is reportedly under active exploitation.