The CVE record (published 15 September 2026, 16:41 UTC; 16 September, 12:41 am Perth) covers CVE-2026-89026 in Issabel Framework (web UI for Issabel PBX / Asterisk). Before commit b97dbaf0b71c1c36f841e672b664afbeb02773bd the pbxapi index.php embeds a hard-coded HS256 JWT signing key identical on every install (CWE-321). Unauthenticated attackers forge bearer tokens and call /pbxapi/manager/originate with the System application parameter so Asterisk runs arbitrary OS commands as the Asterisk user.

The CVE record rates it CVSS 4.0 9.3 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) and CVSS 3.1 9.8. Patch (1 August 2026) replaces the hard-coded key with a key from /etc/issabel.conf. Shadowserver first observed exploitation on 9 September 2026; scale/actors not detailed. Apply the patched framework commit or later; rotate any JWT material that relied on the shared key.

Primary: CVE record; wire: The Hacker News 16 Sep 2026.

Correction (25 Oct 2026): the card date has moved from 15 to 16 September 2026, the Perth date of the CVE record's publication (15 September, 16:41 UTC; 16 September, 12:41 am Perth). (source: CVE.org)