18 September 2026
Reference: CVE-2026-89026
1. What is being reported?
The Issabel Framework uses a secret key to verify users, but this key is the same in every installation and is built into the software. Attackers can create fake access tokens using this key, allowing them to send commands to the phone system and run harmful actions on the server that hosts it.
2. What this means in plain English
If your organisation uses Issabel PBX software, attackers could take control of your phone system remotely. This could lead to phone fraud, disruption of communications, or access to other parts of your network. Because the flaw does not require a password, it is especially dangerous.
3. Could this affect a small business?
Small businesses or charities using Issabel PBX software are at risk. Organisations not using this software or using other phone systems are not affected. If you are unsure whether you use Issabel, check with your IT provider.
4. What to do now
- Contact your IT provider immediately to check if your phone system uses Issabel PBX software.
- Ask your IT provider to apply any available updates or patches that fix this vulnerability.
- If no patch is available, consider isolating the phone system from the internet until a fix is applied.
- Monitor your phone system for unusual activity, such as unexpected calls or system behaviour.
5. Ask your IT provider
Does our phone system use Issabel PBX software, and if so, have you applied the latest security updates to fix the CVE-2026-89026 vulnerability?
6. Bottom line
If you use Issabel PBX, act quickly to update or secure your system to prevent attackers from taking control.
Information based on CISA KEV, NVD, and reputable security reporting.