Attackers Exploit Issabel PBX Flaw for Unauthenticated RCE

Fri, 18 Sep 2026 14:58:07 +0000

Engineer — Act: Active exploitation of an unauthenticated OS command execution flaw (CVSS 9.8) in Issabel PBX — if you run Issabel, patch immediately or isolate the management interface from public network access and audit for indicators of prior compromise.
SOC/IR — Act: Active exploitation reported; hunt for anomalous command execution or outbound connections from Issabel/PBX systems since this vulnerability became public, and check whether any internet-exposed PBX management interfaces exist in the estate.
Leader — Skip
Signals: CVE-2026-89026 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub

Pbx on CuraSec