CVE-2026-28209
Published: 05 March 2026
Summary
CVE-2026-28209 is a high-severity OS Command Injection (CWE-78) vulnerability in Sangoma Freepbx. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection (CWE-78) in network-accessible FreePBX recordings/TTS module directly enables T1190 (public-facing app exploitation over AV:N) leading to arbitrary OS command execution via T1059.004 (Unix shell on Linux-based PBX).
NVD Description
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue…
more
has been patched in versions 16.0.20 and 17.0.5.
Deeper analysisAI
CVE-2026-28209 is a command injection vulnerability (CWE-78) in FreePBX, an open source IP PBX software. It affects versions 16.0.17.2 up to but not including 16.0.20, and versions 17.0.2.4 up to but not including 17.0.5, specifically when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. The vulnerability carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-03-05.
The vulnerability can be exploited over the network by an attacker with high privileges (PR:H), requiring low attack complexity and no user interaction. Successful exploitation enables high-impact compromise of confidentiality, integrity, and availability, allowing arbitrary command execution on the affected FreePBX system.
FreePBX has patched the issue in versions 16.0.20 and 17.0.5. Additional details are available in the security advisory at https://github.com/FreePBX/security-reporting/security/advisories/GHSA-f558-mp87-58vj.
Details
- CWE(s)