🔴 Critical: Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution
-
A critical flaw in the Issabel Framework, the web-based framework that underpins the open-source unified communications PBX software, is now being actively exploited in the wild.
Tracked as CVE-2026-89026, the vulnerability carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3. It allows an unauthenticated remote attacker to run arbitrary operating system commands, with the root cause being a hard-coded value in the framework. Because no authentication is required, any reachable instance could potentially be abused without valid credentials.
Key points to note:
- CVE-2026-89026 affects the Issabel Framework
- Attack type: unauthenticated remote OS command execution
- Severity: 9.8 (CVSS v3.1) / 9.3 (CVSS v4.0)
- Exploitation status: active, confirmed in the wild
If your organization runs Issabel-based PBX or unified communications infrastructure, treat any internet-exposed instance as high risk and review your exposure and patch posture immediately.
Source: The Hacker News
Does your organization run Issabel or a related PBX platform, and if so, how are you handling exposure and mitigation?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login