CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2025-64328

Sangoma FreePBX OS Command Injection Vulnerability

Sangoma FreePBX CWE-78

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

CVSS Score
8.6
High
EPSS — Exploit Probability
85%
Riskier than 100% of all CVEs · checked 2026-09-10
Exploitation
Confirmed in the wild
KEV since 2026-02-03
Remediation
Patch available
Federal deadline 2026-02-24
CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-02-24.

NVD entry Vendor patch PoC / advisory CISA KEV

7 articles across 4 outlets · first covered May 27, 2026 · latest May 27, 2026

Associated threat actors

INJ3CTOR3

Coverage timeline

Related CVEs — Sangoma

CVE-2026-9586KEV CVE-2025-57819KEV CVE-2019-19006KEV