# CVE-2026-89026: Issabel Framework - RCE

> Live exploitation tracking for CVE-2026-89026 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-89026

## Key facts

- **Exploitation phase:** Active Exploitation. The vulnerability is actively exploited at scale across the internet, often via automated tools and large attack campaigns.
- **CVSS score:** 9.3
- **Public exploit available:** Yes
- **Affected products:** Issabel Foundation Issabel Framework
- **Weaknesses:** CWE-321 (Use of Hard-coded Cryptographic Key)
- **Tags:** web_application, management_panel

## Description

The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key in the pbxapi index.php file that is identical across every installation, allowing unauthenticated remote attackers to forge valid bearer tokens. Attackers can use the forged token to call the manager originate endpoint with the System application parameter, causing Asterisk to execute arbitrary OS commands as the Asterisk user. Exploitation evidence was first observed by the Shadowserver Foundation on 2026-09-09.

## CrowdSec analysis

[CVE-2026-89026](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-89026) is a critical vulnerability in the Issabel Framework caused by a hard-coded JWT signing key shared across installations. Unauthenticated remote attackers can forge valid tokens and exploit the manager originate endpoint to execute arbitrary operating system commands as the Asterisk user, potentially compromising affected systems.

CrowdSec has been tracking this vulnerability and its exploits since 24th of October 2026.

According to CrowdSec data, while opportunistic exploitation dominates, a portion of threat actors trying to exploit CVE-2026-89026 apply basic targeting methods such as port or service detection. This indicates emerging patterns of selective targeting.
In addition, according to the CrowdSec network, attack volume against CVE-2026-89026 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Observed exploitation attempts target `/pbxapi/manager/extensionstate` with forged HS256 bearer tokens to test whether the PBX API accepts JWTs signed with a hard-coded key. Successful authentication may enable attackers to abuse other PBX API actions for further compromise.

## Timeline

- 2026-09-15: CVE Published. CVE-2026-89026 is published to NVD.
- 2026-10-24: Rule Released. CrowdSec releases a rule to detect CVE-2026-89026 exploitation attempts against the CrowdSec Network.
- 2026-10-28: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2026-89026 for the first time.

## References

- https://github.com/IssabelFoundation/framework/commit/b97dbaf0b71c1c36f841e672b664afbeb02773bd
- https://www.vulncheck.com/advisories/issabel-pbx-hard-coded-jwt-key-rce-via-pbxapi-manager-originate
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-89026.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-89026) follows observed exploitation activity for CVE-2026-89026. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.