CVE-2026-28284
Published: 05 March 2026
Summary
CVE-2026-28284 is a high-severity SQL Injection (CWE-89) vulnerability in Sangoma Freepbx. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 10.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents SQL injection vulnerabilities in the FreePBX logfiles module by requiring validation of all user inputs used in SQL queries.
Mitigates the CVE by mandating timely flaw remediation through patching to FreePBX versions 16.0.10 or 17.0.5 where the SQLi issues are fixed.
Supports mitigation by enabling vulnerability scanning to identify SQL injection flaws like those in the logfiles module prior to exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authenticated SQL injection in the web-exposed logfiles module of FreePBX (public-facing IP PBX application) directly enables remote exploitation of the application by low-privilege users, matching T1190 for initial access or impact.
NVD Description
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, the FreePBX logfiles module contains several authenticated SQL injection vulnerabilities. This issue has been patched in versions 16.0.10 and 17.0.5.
Deeper analysisAI
CVE-2026-28284 involves several authenticated SQL injection vulnerabilities (CWE-89) in the logfiles module of FreePBX, an open source IP PBX software. These flaws affect FreePBX versions prior to 16.0.10 and 17.0.5, allowing improper handling of SQL queries that can be manipulated by authorized users.
Attackers with low-privilege authenticated access (PR:L) can exploit these vulnerabilities remotely over the network (AV:N) with low attack complexity (AC:L) and no user interaction required (UI:N). Successful exploitation enables high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), with an unchanged scope (S:U), resulting in a CVSS v3.1 base score of 8.8.
The issue has been patched in FreePBX versions 16.0.10 and 17.0.5. Additional details on the vulnerabilities and remediation are available in the GitHub security advisory at https://github.com/FreePBX/security-reporting/security/advisories/GHSA-4887-4jwp-327g.
Details
- CWE(s)