Loading vulnerability…
CVE-2026-89026 is a critical remote code execution vulnerability in the Issabel Framework used by Issabel PBX. Affected versions use an HS256 JSON Web Token signing key that is hard-coded and shared across installations. An unauthenticated remote attacker can use this key to forge a bearer token accepted by the PBX API, then invoke the Asterisk Manager originate functionality with the System application to execute arbitrary operating-system commands as the Asterisk service account.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical (CVSS v3.1 9.8; CVSS v4.0 9.3) unauthenticated remote OS-command-execution vulnerability in Issabel Framework. A hard-coded HS256 JWT signing key permits attackers to forge bearer tokens and invoke the /pbxapi/manager/originate endpoint with Asterisk's System application, executing commands as the Asterisk user.
A critical unauthenticated remote OS-command-execution vulnerability in the Issabel Framework caused by a hard-coded HS256 JWT signing key in pbxapi/index.php. Attackers can forge bearer tokens and abuse the pbxapi/manager/originate endpoint to invoke Asterisk's System application as the Asterisk service account.
A critical unauthenticated remote OS command-execution vulnerability in the Issabel Framework caused by a hard-coded HS256 JWT signing key in pbxapi/index.php. Attackers can forge bearer tokens and abuse the pbxapi/manager/originate endpoint to invoke Asterisk's System application and execute commands as the Asterisk service account.
A critical unauthenticated remote code execution vulnerability in the Issabel Framework used by Issabel PBX. A globally reused hard-coded HS256 JWT signing key enables attackers to forge bearer tokens and invoke Asterisk's System application through the manager originate endpoint, executing operating-system commands as the Asterisk user.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.