CVE-2026-28287Disclosure(sangoma / freepbx)

LOWCVSS 8.8 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

sangoma CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-9vv6-h8v6-rp4q

Weakness type (CWE)

CWE-78

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

freepbx

Threat summary

5 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 4 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-03-06); latest day: 1
5 total mentions across 4 days

Affected systems

Vendors

sangoma

Products

freepbx

Deep dive

Activity timeline5 mentions / 4d

Signal classification2 categories

Disclosure

480.0%

General

120.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-05	1	Disclosure1
2026-03-06	2	Disclosure2
2026-03-08	1	Disclosure1
2026-03-17	1	General1

Full discourse5 posts

ET Labs@ET_Labs205d
General
35 new OPEN, 66 new PRO (35 + 31) ACR Stealer, Katana Botnet, Lumma Stealer, NetSupport RAT, TA4903, TA569, XWorm, FreePBX (CVE-2026-28287), Linksys (CVE-2025-34037), Microsoft Exchange (CVE-2021-28480, CVE-2021-28481), Nginx-ui (CVE-2026-27944) and more. https://community.emergingthreats.net/t/ruleset-update-summary-2026-03-17-v11150/3235 https://t.co/SNltFetetX
Post summary
The post lists several new threat rules containing multiple CVEs but provides no evidence of PoCs, exploits, patches, or active exploitation.
03050465
5.7K followersView on X
The Hacker Wire@TheHackerWire215d
Disclosure
🟠 CVE-2026-28287 - High FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings modu... https://www.thehackerwire.com/vulnerability/CVE-2026-28287/ https://t.co/SVU4O8lfTJ
Post summary
The tweet announces CVE‑2026‑28287 as a high‑severity command injection flaw affecting specific FreePBX versions, linking to an external vulnerability report.
0000036
130 followersView on X
DailyCVE@dailycve216d
Disclosure
🔴 FreePBX, Command Injection, #CVE-2026-28287 (Critical) https://dailycve.com/freepbx-command-injection-cve-2026-28287-critical/
Post summary
A new critical command injection vulnerability (CVE-2026-28287) in FreePBX has been disclosed.
0000031
166 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds217d
Disclosure
CVE-2026-28287 Command Injection Vulnerabilities in FreePBX Recordings Module 16.0 and 17.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-28287
Post summary
A new command injection vulnerability in FreePBX Recordings Module 16.0 and 17.0 has been disclosed, but the post contains no proof‑of‑concept, exploit, or patch details.
0000048
4.0K followersView on X
CVE@CVEnew217d
Disclosure
CVE-2026-28287 FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exi… https://www.cve.org/CVERecord?id=CVE-2026-28287
Post summary
The text announces CVE‑2026‑28287, indicating multiple command injection vulnerabilities affecting specific FreePBX versions, but provides no PoC, exploit code, or patch details.
00000100
56.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sangoma	freepbx	-	-	-

Explore more

Back to dashboard sangoma CVEs freepbx vulnerabilities

What researchers are saying

CVE-2026-28287

ET Labs@ET_LabsGeneral

The post lists several new threat rules containing multiple CVEs but provides no evidence of PoCs, exploits, patches, or active exploitation.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces CVE‑2026‑28287 as a high‑severity command injection flaw affecting specific FreePBX versions, linking to an external vulnerability report.

DailyCVE@dailycveDisclosure

A new critical command injection vulnerability (CVE-2026-28287) in FreePBX has been disclosed.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

A new command injection vulnerability in FreePBX Recordings Module 16.0 and 17.0 has been disclosed, but the post contains no proof‑of‑concept, exploit, or patch details.

CVE@CVEnewDisclosure

The text announces CVE‑2026‑28287, indicating multiple command injection vulnerabilities affecting specific FreePBX versions, but provides no PoC, exploit code, or patch details.