PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-64328 Sangoma CVE debrief

CVE-2025-64328 is a Sangoma FreePBX operating-system command injection vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2026-02-03. That listing means the issue is considered actively exploited in the wild, so defensive action should be prioritized immediately. The supplied corpus does not include affected versions, CVSS scoring, or vendor advisory text, so remediation should follow the official vendor and CISA guidance linked below.

Vendor
Sangoma
Product
FreePBX
CVSS
HIGH 8.6
CISA KEV
Listed
Original CVE published
2026-02-03
Original CVE updated
2026-02-03
Advisory published
2026-02-03
Advisory updated
2026-02-03

Who should care

Security and IT teams responsible for Sangoma FreePBX deployments should prioritize this issue, especially administrators, vulnerability management teams, and incident response staff. If FreePBX is used in hosted or cloud environments, service owners should also review CISA’s guidance for cloud services and determine whether mitigations can be applied safely.

Technical summary

The available official sources describe CVE-2025-64328 as an OS command injection vulnerability in Sangoma FreePBX. CISA’s KEV catalog entry confirms known exploitation and assigns a remediation due date of 2026-02-24. No additional technical details, affected versions, or severity score are provided in the supplied corpus.

Defensive priority

Urgent. This is a known-exploited vulnerability in a communications platform, so exposure should be treated as a high-priority remediation item with immediate validation and mitigation planning.

Recommended defensive actions

  • Confirm whether any FreePBX instances are in use, including hosted or cloud-managed deployments.
  • Apply vendor-recommended mitigations as soon as they are available and validated.
  • Track CISA’s KEV due date of 2026-02-24 as the remediation deadline.
  • If mitigations are unavailable, discontinue use of the product or remove the exposed service as CISA directs.
  • Review logs and security alerts for signs of compromise on affected systems.
  • Coordinate with incident response and change management before making production changes.

Evidence notes

CISA’s Known Exploited Vulnerabilities catalog lists CVE-2025-64328 as a Sangoma FreePBX OS command injection vulnerability, with dateAdded 2026-02-03 and dueDate 2026-02-24. The supplied source metadata also points to the official CVE record and NVD detail page, but the corpus does not provide vendor advisory text, affected versions, or CVSS scoring.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-64328 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-64328

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-64328 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-64328

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.