Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution

A critical security flaw in the Issabel Framework is being actively exploited by attackers. The vulnerability allows an unauthenticated remote attacker to execute arbitrary operating system commands. It has a CVSS v3.1 score of 9.8 and a CVSS v4.0 score of 9.3, indicating a high level of severity. The flaw is identified as CVE-2026-89026 and is related to a hard-coded issue in the framework. This vulnerability can be exploited without authentication, making it a significant threat. The Issabel Framework is used in open-source unified communications PBX software.