CVE-2026-28284

High

Published: 05 March 2026

Published

05 March 2026

Modified

06 March 2026

KEV Added

—

Patch

—

CVSS Score v4 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Score 0.0025 15.8th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-28284 is a high-severity SQL Injection (CWE-89) vulnerability in Sangoma Freepbx. Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 15.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2026-28284 involves several authenticated SQL injection vulnerabilities (CWE-89) in the logfiles module of FreePBX, an open source IP PBX software. These flaws affect FreePBX versions prior to 16.0.10 and 17.0.5, allowing improper handling of SQL queries that can be manipulated by authorized users.

Attackers with low-privilege authenticated access (PR:L) can exploit these vulnerabilities remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation enables high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an unchanged scope (S:U), resulting in a CVSS v3.1 base score of 8.8.

The issue has been patched in FreePBX versions 16.0.10 and 17.0.5. Additional details on the vulnerabilities and remediation are available in the GitHub security advisory at https://github.com/FreePBX/security-reporting/security/advisories/GHSA-4887-4jwp-327g.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-9861

Vulnerability details

FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilities. This issue has been patched in versions 16.0.10 and 17.0.5.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Authenticated SQL injection in the web-exposed logfiles module of FreePBX (public-facing IP PBX application) directly enables remote exploitation of the application by low-privilege users, matching T1190 for initial access or impact.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0