Critical RCE Flaw in Issabel Framework Actively Exploited

Security researchers have identified active exploitation of a critical vulnerability in Issabel Framework, a popular open-source platform for unified communications and PBX systems. The flaw, tracked as CVE-2026-89026, enables remote attackers to execute arbitrary operating system commands without authentication.

With a CVSS v3.1 score of 9.8 and CVSS v4.0 score of 9.3, this represents a severe risk to organizations deploying vulnerable versions of the software. The vulnerability stems from a hard-coded implementation issue that attackers can leverage to gain complete system control.

Technical Impact

• The vulnerability allows unauthenticated remote command execution with the same privileges as the web server process
• Attackers can install malware, steal sensitive data, or use compromised systems for further attacks
• No user interaction or authentication is required to exploit this flaw
• The hard-coded nature of the vulnerability makes it particularly dangerous across deployments

Affected Systems and Recommendations

• Organizations running Issabel Framework versions prior to the latest patched release are at risk
• Systems used for VoIP, unified communications, and PBX services should be prioritized for assessment
• Immediate actions include applying vendor patches, implementing network segmentation, and monitoring for suspicious activity
• Consider temporary isolation of affected systems if patching is not immediately possible
• Review system logs for evidence of exploitation, including unusual command execution patterns

Sources

• Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution