Attackers are actively exploiting a critical vulnerability in the Issabel Framework, a web-based framework used by open-source unified communications PBX software. The flaw, tracked as CVE-2026-89026, allows unauthenticated OS command execution and carries CVSS scores of 9.8 under version 3.1 and 9.3 under version 4.0.
Because the vulnerability is already being exploited in the wild, organizations running Issabel-based systems should prioritize patching and monitoring. The report does not include patch details or indicators of compromise, so administrators should consult official vendor guidance for mitigation steps.
As there is only one source, there are no differing accounts to compare. The key facts are limited to the active exploitation, the affected framework, and the critical severity ratings.