CVE-2025-64328 Sangoma FreePBX
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the…
- CVSS
- not scored
On CISA’s exploited list
Sangoma FreePBX OS Command Injection Vulnerability
- Added
- 2026-02-03
- Federal patch deadline
- 2026-02-24
- Ransomware use
- not known