CVE-2026-28209
Published: 05 March 2026
Summary
CVE-2026-28209 is a high-severity OS Command Injection (CWE-78) vulnerability in Sangoma Freepbx. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 36.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-28209 is a command injection vulnerability (CWE-78) in FreePBX, an open source IP PBX software. It affects versions 16.0.17.2 up to but not including 16.0.20, and versions 17.0.2.4 up to but not including 17.0.5, specifically when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-05.
The vulnerability can be exploited over the network by an attacker with high privileges (PR:H), requiring low attack complexity and no user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, allowing arbitrary command execution on the affected FreePBX system.
FreePBX has patched the issue in versions 16.0.20 and 17.0.5. Additional details are available in the security advisory at https://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87-58vj.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9856
Vulnerability details
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue…
more
has been patched in versions 16.0.20 and 17.0.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-78) in network-accessible FreePBX recordings/TTS module directly enables T1190 (public-facing app exploitation over AV:N) leading to arbitrary OS command execution via T1059.004 (Unix shell on Linux-based PBX).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation and sanitization of inputs to the ElevenLabs TTS recordings module, blocking the special characters that enable CWE-78 command injection.
Mandates timely application of the vendor patches that eliminate the command-injection flaw in FreePBX 16.0.20 and 17.0.5.
Limits the number of accounts granted the high privileges required to reach the vulnerable TTS configuration page, reducing the attack surface.