Issabel Framework Flaw Triggers Remote Code Execution – Critical CVE‑2026‑89026 Exploited

Issabel Framework flaw enables unauthenticated OS command execution

The open‑source communications platform built on Issabel Framework flaw is now the target of active weaponization. Security researchers have confirmed that CVE‑2026‑89026, rated ↓ 9.8 under CVSS v3.1 and ↓ 9.3 under v4.0, permits any unauthenticated attacker to inject OS commands via a hard‑coded execution path. Exploitation appears in the wild, with botnets probing vulnerable installations worldwide. Enterprises deploying the PBX software are urged to apply the emergency patch released this week.

“We are observing active attempts to compromise systems within minutes of scanning,” said a senior analyst at Reuters.

The flaw resides in the module that parses inbound HTTP parameters, bypassing authentication checks. Mitigation steps include disabling the vulnerable endpoint, updating to version 4.2.1, and monitoring logs for suspicious command strings.

Issabel Framework flaw mitigation checklist

• Upgrade to the latest release
• Restrict network access to the management interface
• Enable intrusion detection signatures for CVE‑2026‑89026

For a deeper technical breakdown, see the advisory posted by the Bloomberg security desk.