Known Exploited Vulnerabilities February 03, 2026 · CISA KEV Catalog

CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability

Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user.

Read the original at CISA KEV Catalog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2025-64328 Sangoma
Related: CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability Known Exploited Vulnerabilities · Sep 02, 2026
CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability Known Exploited Vulnerabilities · Feb 03, 2026
CVE-2025-57819: Sangoma FreePBX Authentication Bypass Vulnerability Known Exploited Vulnerabilities · Aug 29, 2025