Issabel Framework - RCE (CVE-2026-89026)

CVE-2026-89026 is a critical vulnerability in the Issabel Framework caused by a hard-coded JWT signing key shared across installations. Unauthenticated remote attackers can forge valid tokens and exploit the manager originate endpoint to execute arbitrary operating system commands as the Asterisk user, potentially compromising affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-89026 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting. In addition, according to the CrowdSec network, attack volume against CVE-2026-89026 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts target /pbxapi/manager/extensionstate with forged HS256 bearer tokens to test whether the PBX API accepts JWTs signed with a hard-coded key. Successful authentication may enable attackers to abuse other PBX API actions for further compromise.