[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOUUqhy6Bgpcn3CdHJw5xuoGjO-J2s4xyBtkxXxT_ZKc":3},{"article":4,"iocs":43,"watch_terms":48,"solutions":49,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"81eebb97-a49d-48a4-a250-19e45adad1ba","Attackers Exploit Issabel Framework Flaw Enabling Unauthenticated OS Command Execution","attackers-exploit-issabel-framework-flaw-enabling-unauthenticated-os-command-exe-4a5197","A critical security flaw in Issabel Framework, a web-based framework for the open-source unified communications PBX software, has come under active exploitation. The vulnerability in question is CVE-2026-89026 (CVSS v3.1 score: 9.8\u002FCVSS v4.0 score: 9.3), which can allow an unauthenticated remote attacker to execute arbitrary operating system (OS) commands by taking advantage of a hard-coded","A critical vulnerability (CVE-2026-89026) in the Issabel Framework, an open-source PBX software, is being actively exploited. The flaw allows unauthenticated remote attackers to execute arbitrary OS commands by exploiting a hard-coded JWT signing key. A patch was released on August 1, 2026, replacing the hard-coded key with one stored in a configuration file.","Issabel Framework vulnerability CVE-2026-89026 is actively exploited, allowing unauthenticated OS command execution.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattackers-exploit-issabel-framework.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEh5aXi8Vt3MH8e38-ViNXz-m4hRPrbqDMGcpbMtOc3b-cDLIyEZEjqGvSscW6mR34ZrmPM4lSnv6C9XFTHlgq3UyGLA24gySGqcCzdKr-hIY2QZO8VSXnC-KAsdEz6vTkgdRnVxAZVM7NyrhgpL2xDWR8lcvPInEwgvj0pTgHkC7KStUFglwcLext7eb3w5\u002Fs1600\u002Fissa.jpg","2026-09-16T15:50:59+00:00","2026-09-16T18:00:15.99036+00:00",8,[17,20,23],{"name":18,"type":19},"Issabel Framework","product",{"name":21,"type":22},"PBX software","technology",{"name":24,"type":22},"JSON Web Token (JWT)","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,33,38],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[44],{"type":45,"value":46,"context":47},"cve","CVE-2026-89026","Critical vulnerability in Issabel Framework allowing OS command execution.",[18],{"controls":50,"vendors":130},[51,80,105],{"slug":52,"name":53,"problem":54,"products":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":81,"name":82,"problem":83,"products":84},"patch-management","Automated patch management","Known holes get closed in days, not months.",[85,89,97],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":81,"product_name":86,"url":87,"description":88},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"slug":42,"name":106,"problem":107,"products":108},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":126,"product_name":127,"url":128,"description":129},"agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":148},"hard-coded-jwt-key-in-issabel-pbx-enables-unauthenticated-remote-code-execution","Hard-Coded JWT Key in Issabel PBX Enables Unauthenticated Remote Code Execution","The root cause of this breach is a hard-coded JWT signing key embedded directly in the Issabel Framework source code, a classic configuration management failure that allows any attacker with knowledge of the key to forge authenticated tokens and execute arbitrary OS commands without credentials. Because the key was static and shared across all installations, every deployment was equally vulnerable the moment the key became known. This matters greatly because PBX systems handle sensitive voice communications and are often internet-facing, making them high-value targets for espionage, toll fraud, and lateral movement into internal networks. Active exploitation before many organizations could patch underscores the danger of secrets baked into open-source codebases, where they can be discovered through simple source code review. The incident highlights that secure secret management must be a design requirement, not an afterthought.",[136,137,138,139,140,141,142,143,144,145,146,147],"CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 IA-5: Authenticator Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 SC-28: Protection of Information at Rest","NIST CSF ID.AM-2: Software platforms and applications within the organization are inventoried","OWASP A02:2021 – Cryptographic Failures","OWASP A05:2021 – Security Misconfiguration","ITIL Change Management: Emergency Change procedures for critical vulnerability patching","GDPR Article 32: Security of processing (where PBX handles personal voice data)",{}]