Affected Systems
Issabel Framework (all versions prior to August 1, 2026 patch). Issabel is a web-based framework for open-source unified communications PBX software built on Asterisk. The vulnerability affects the pbxapi component with a hard-coded JWT signing key identical across all installations.
Exploitation Status
Active exploitation confirmed since September 9, 2026, per Shadowserver Foundation telemetry. Attackers are forging JWT tokens using the hard-coded key "da893kasdfam43k29akdkfaFFlsdfhj23rasdf" to execute OS commands via the /pbxapi/manager/originate endpoint. Scale and attribution unknown.
Business Impact
Unauthenticated remote attackers can execute arbitrary OS commands as the Asterisk user on vulnerable Issabel Framework installations. This grants full control over the PBX system, enabling call interception, toll fraud, data exfiltration, lateral movement, and potential ransomware deployment. Organizations using Issabel for VoIP/unified communications face immediate risk of compromise. CVSS 9.8 (v3.1) / 9.3 (v4.0).
Urgency
🔴 Immediate
Recommended Actions
- Immediately apply the August 1, 2026 patch for Issabel Framework that replaces the hard-coded JWT key with a unique key stored in /etc/issabel.conf
- Audit all Issabel Framework instances for indicators of compromise: review Asterisk logs for unexpected originate commands, check for unauthorized user accounts, and inspect system logs for suspicious command execution since September 9, 2026
- If patching cannot be completed immediately, restrict network access to the /pbxapi/ endpoint to trusted management IPs only via firewall or web server ACLs
- Rotate all credentials and API keys associated with Issabel and Asterisk systems after patching, assuming potential prior compromise
- Monitor outbound connections from Issabel servers for C2 traffic and review call detail records (CDRs) for anomalous call patterns or toll fraud indicators