Issabel Framework
Monthly
Unauthenticated remote command execution in Issabel Framework (the web framework bundled with Issabel PBX) lets any attacker who can reach the pbxapi endpoint forge valid HS256 JSON Web Tokens, because the signing key was a fixed string identical on every installation prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. With a forged bearer token the attacker calls the Asterisk manager originate endpoint using the System application parameter, causing Asterisk to execute arbitrary operating-system commands as the unprivileged Asterisk service user. Rated 9.3 (CVSS 4.0) / assessed 9.8 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and the Shadowserver Foundation observed exploitation evidence beginning 2026-09-09; there is no CISA KEV entry and no public exploit-code reference in the supplied data, but the hard-coded key is trivially recoverable from the public source, so treat exposure as urgent.
Unauthenticated remote command execution in Issabel Framework (the web framework bundled with Issabel PBX) lets any attacker who can reach the pbxapi endpoint forge valid HS256 JSON Web Tokens, because the signing key was a fixed string identical on every installation prior to commit b97dbaf0b71c1c36f841e672b664afbeb02773bd. With a forged bearer token the attacker calls the Asterisk manager originate endpoint using the System application parameter, causing Asterisk to execute arbitrary operating-system commands as the unprivileged Asterisk service user. Rated 9.3 (CVSS 4.0) / assessed 9.8 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N) with no authentication or user interaction required, and the Shadowserver Foundation observed exploitation evidence beginning 2026-09-09; there is no CISA KEV entry and no public exploit-code reference in the supplied data, but the hard-coded key is trivially recoverable from the public source, so treat exposure as urgent.