All CVEs
Vulnerability intelligence

CVE-2025-64328

Sangoma FreePBX OS Command Injection Vulnerability

Sangoma FreePBX CWE-78

FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. In versions 17.0.2.36 and above before 17.0.3, the filestore module within the Administrative interface is vulnerable to a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to obtain remote access to the system as an asterisk user. This issue is fixed in version 17.0.3.

CVSS Score
8.6
High
EPSS — Exploit Probability
75%
Riskier than 99% of all CVEs
Exploitation
Confirmed in the wild
Used in ransomware campaigns
Remediation
Patch available
Federal deadline 2026-02-24
CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-02-24.

NVD entry Vendor patch PoC / advisory CISA KEV

1 article across 1 outlet · first covered May 27, 2026 · latest May 27, 2026

Associated threat actors

Coverage timeline

Related CVEs — Sangoma