Hackers Are Actively Exploiting a Critical Issabel Flaw That Hands Over Full Server Control
CVE-2026-89026 lets unauthenticated attackers run any command they want on vulnerable phone-system servers. Attacks are already happening.
Key points
- CVE-2026-89026 is a critical flaw in Issabel Framework, the web control panel for a popular open-source office phone system, scored 9.8 out of 10.
- Attackers need no password to exploit it and can run any command on the server.
- Active exploitation is under way, according to reporting picked up by The Hacker News.
- The root cause is a hard-coded credential baked into the software, meaning a secret that ships the same on every install.
- Any organisation running Issabel Framework on an internet-facing server should treat this as an emergency patch job.
A serious flaw in Issabel Framework, the web-based control panel for the Issabel open-source office phone system, is being actively exploited. The bug is tracked as CVE-2026-89026 and carries a severity score of 9.8 out of 10 on the CVSS v3.1 scale, and 9.3 on the newer CVSS v4.0 scale. Both readings put it in the drop-everything bracket.
An attacker with no username or password can send a crafted request to a vulnerable server and run operating system commands on it. That's as bad as web bugs get.
What is Issabel and who uses it?
Issabel is free software that turns a Linux server into an office phone system, managing calls and voicemail for small businesses, call centres and IT integrators who want an alternative to paid platforms. The Framework component is the web dashboard administrators use to manage the whole thing.
If your company's phones run on Issabel, the box in your comms cupboard is exactly the kind of machine at risk.
How does the attack work?
The flaw is a hard-coded credential, a secret login value the developers built directly into the code. Every installation ships with the same secret. Once an attacker knows it, and once a bug like this is public they do, they can talk to the server as if they were already trusted, then pipe commands straight through to the underlying operating system.
No phishing. No prior foothold needed. Just a network path to the server and the knowledge that the secret exists.
The score is 9.8 because the only real barrier is whether the Issabel web interface is reachable from the attacker's network. For plenty of deployments it is, sitting open on the public internet.
What can attackers actually do with it?
Everything. Command execution as the web server user typically means an attacker can read call recordings, harvest SIP credentials (the logins that authorise your phone lines) to place fraudulent international calls, pivot into the internal network, or deploy ransomware. Toll fraud alone can generate five-figure phone bills across a single weekend on a compromised system.
This isn't theoretical. Reported active exploitation means someone is already running the playbook. We covered a structurally similar case on 2 September, when a severe bug in Sangoma's Switchvox phone platform let attackers run code without a password and exploitation was already under way before most admins had heard about it.
The numbers at a glance
| Item | Detail |
|---|---|
| CVE ID | CVE-2026-89026 |
| CVSS v3.1 | 9.8 (critical) |
| CVSS v4.0 | 9.3 (critical) |
| Authentication required | None |
| Root cause | Hard-coded credential |
| Status | Actively exploited |
What should administrators do right now?
Get the Issabel web interface off the public internet today, before the patch. Restrict access to a management VPN or a small allow-list of admin IP addresses. Check the server for signs of intrusion: new user accounts, unfamiliar scheduled tasks, outbound connections to addresses you don't recognise, and unusual international call traffic.
Apply the vendor's fix as soon as it is available and rotate every credential the server touches, including SIP trunk passwords and shared admin accounts.
Should you worry about your other network appliances too?
Yes. Hard-coded credentials in 2026 are inexcusable, and they keep appearing in exactly the kind of appliance-style software that quietly runs critical business functions. If you run a phone system, a network recorder or a building controller, assume the vendor buried one of these in the code and lock the management interface away from the internet on principle. Waiting for a CVE to confirm it is too late.
