Secuno
ENNL
Book demo

CVE-2026-89026

9.8 CRITICAL
  1. Published15 Sept 2026

Description

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-909459.8
Crawlab through 0.6.3 uses a hard-coded HMAC-SHA256 secret for JWT token signing that…
CVE-2026-905108.3
A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This…
CVE-2026-879299.8
MaxSite CMS through 109.6 ships with a hardcoded session encryption key in…
CVE-2026-539399.1
OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption…
CVE-2026-818218.4
The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards…
CVE-2026-754319.1
PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key…

Frequently asked

Is CVE-2026-89026 being actively exploited?

CVE-2026-89026 is not in the CISA KEV catalog.

How severe is CVE-2026-89026?

CVE-2026-89026 has a CVSS 3.1 base score of 9.8, rated critical.

How do I fix CVE-2026-89026?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-89026 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.