What’s Vulnerable › Products

Sangoma FreePBX vulnerabilities

50 known vulnerabilities, 2 confirmed exploited in the wild (CISA KEV), 28 published in the last 12 months.

Check whether your Sangoma FreePBX version is affected

Exploited Sangoma FreePBX vulnerabilities

• CVE-2019-19006 — Sangoma FreePBX Improper Authentication Vulnerability
• CVE-2025-57819 — Sangoma FreePBX Authentication Bypass Vulnerability

Latest Sangoma FreePBX vulnerabilities

• CVE-2026-75600 — FreePBX: Authenticated API generatedocs Host Command Injection (CVSS 8.8)
• CVE-2026-54710 — FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion) (CVSS 8.8)
• CVE-2026-54708 — Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module (CVSS 8.8)
• CVE-2026-54675 — FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module (CVSS 8.8)
• CVE-2026-54674 — Authenticated Command Injection in FreePBX UCP Interface (CVSS 8.8)
• CVE-2026-45562 — FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module (CVSS 7.2)
• CVE-2026-73665 — FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection (CVSS 9.8)
• CVE-2026-73663 — FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover (CVSS 9.8)
• CVE-2026-73662 — Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files (CVSS 7.2)
• CVE-2026-73661 — FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup (CVSS 6.5)
• CVE-2026-46376 — FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface (CVSS 9.8)
• CVE-2026-44239 — FreePBX: Authenticated Local File Inclusion in Dashboard Module (CVSS 8.8)
• CVE-2026-44238 — FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports (CVSS 8.8)
• CVE-2026-44237 — FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module (CVSS 8.1)
• CVE-2026-28287 — FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints (CVSS 8.8)
• CVE-2026-28284 — FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module (CVSS 8.8)
• CVE-2026-28210 — FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports (CVSS 8.8)
• CVE-2026-28209 — FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration (CVSS 7.2)
• CVE-2025-55210 — FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes (CVSS 7.5)
• CVE-2025-67736 — Authenticated SQL Injection in FreePBX tts (Text To Speech) module (CVSS 7.2)
• CVE-2025-67722 — Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation (CVSS 7.8)
• CVE-2024-58294 — FreePBX 16 Authenticated Remote Code Execution via API Module (CVSS 8.8)
• CVE-2025-66039 — FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header (CVSS 9.8)
• CVE-2025-59429 — FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page (CVSS 5.4)
• CVE-2025-59056 — FreePBX vulnerable to unauthenticated Denial of Service (CVSS 7.5)