<![CDATA[🔴 Critical: Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution]]>A critical flaw in the Issabel Framework, the web-based framework that underpins the open-source unified communications PBX software, is now being actively exploited in the wild.

Tracked as CVE-2026-89026, the vulnerability carries a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3. It allows an unauthenticated remote attacker to run arbitrary operating system commands, with the root cause being a hard-coded value in the framework. Because no authentication is required, any reachable instance could potentially be abused without valid credentials.

Key points to note:

  • CVE-2026-89026 affects the Issabel Framework
  • Attack type: unauthenticated remote OS command execution
  • Severity: 9.8 (CVSS v3.1) / 9.3 (CVSS v4.0)
  • Exploitation status: active, confirmed in the wild

If your organization runs Issabel-based PBX or unified communications infrastructure, treat any internet-exposed instance as high risk and review your exposure and patch posture immediately.

Source: The Hacker News

Does your organization run Issabel or a related PBX platform, and if so, how are you handling exposure and mitigation?

]]>https://xploitlk.com/topic/363/critical-attackers-exploit-issabel-framework-flaw-enabling-unauthenticated-os-command-executionRSS for NodeTue, 27 Oct 2026 11:22:29 GMTThu, 17 Sep 2026 04:30:26 GMT60