- Engineer — Act: Active exploitation of an unauthenticated OS command execution flaw (CVSS 9.8) in Issabel PBX — if you run Issabel, patch immediately or isolate the management interface from public network access and audit for indicators of prior compromise.
- SOC/IR — Act: Active exploitation reported; hunt for anomalous command execution or outbound connections from Issabel/PBX systems since this vulnerability became public, and check whether any internet-exposed PBX management interfaces exist in the estate.
- Leader — Skip
- Signals: CVE-2026-89026 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub