Sangoma FreePBX flaws CVE-2019-19006 and CVE-2025-64328 exploited; fixes available
Two patched FreePBX flaws are being exploited: one bypasses admin passwords; the other lets authenticated users run commands. Ask your business phone-system administrator to update the affected modules, restrict admin access and check for compromise.
If your office or telephone provider uses FreePBX, ask its administrator to update Filestore to 17.0.3 or later and verify the Framework fixes: 13.0.197.14, 14.0.13.12 or 15.0.16.27 for branches 13, 14 or 15 respectively. Ask them to restrict access to the administrator interface and check for unauthorised accounts, malware and suspicious calls. Systems already compromised need incident recovery as well as updates.
What’s happening
Two flaws in Sangoma FreePBX, software used to manage business telephone systems, were added to CISA’s exploited-vulnerability catalogue on 3 February 2026. CVE-2019-19006 allows access to administrator services without a valid password; Sangoma released Framework fixes in November 2019. CVE-2025-64328 lets an authenticated administrator-panel user run commands as the system’s asterisk account. FreePBX identifies the affected component as Filestore in FreePBX 17 and provides a fix in Filestore 17.0.3. FortiGuard Labs reported attackers exploiting the newer flaw from early December 2025 to install persistent EncystPHP malware and abuse telephone resources. Shadowserver counted more than 900 compromised IP addresses on 24 February; The Hacker News subsequently reported the infections were likely linked to that flaw. Both vulnerabilities have released fixes, but updating does not establish that an already compromised server is clean. As of 3 November, the reviewed sources provide no campaign-wide all-clear.
- What
- Flaw
- Affects
- Sangoma FreePBX and PBXact business telephone systems
- Affected
- CVE-2019-19006: FreePBX/PBXact 13 with Framework earlier than 13.0.197.14
CVE-2019-19006: FreePBX/PBXact 14 with Framework earlier than 14.0.13.12
CVE-2019-19006: FreePBX/PBXact 15 with Framework earlier than 15.0.16.27
CVE-2025-64328: FreePBX 17 Filestore module >= 17.0.2.36 and < 17.0.3 - Fixed in
- CVE-2019-19006: FreePBX/PBXact 13 Framework 13.0.197.14
CVE-2019-19006: FreePBX/PBXact 14 Framework 14.0.13.12
CVE-2019-19006: FreePBX/PBXact 15 Framework 15.0.16.27
CVE-2025-64328: FreePBX 17 Filestore module 17.0.3 - Since
- 3 Feb 2026
- Closed
- 24 Feb 2026
Timeline
- Wider attacks
Shadowserver said it still observed more than 900 IP addresses hosting compromised FreePBX systems with malicious remote-access scripts, following collaboration with the Canadian Centre for Cyber Security.
- CISA added
CISA added both CVE-2019-19006 and CVE-2025-64328 to its Known Exploited Vulnerabilities catalogue, confirming exploitation. It set a 24 February remediation deadline for covered US federal agencies; ransomware use was unknown.
- Wider attacks
FortiGuard Labs reported attacks exploiting CVE-2025-64328 since early December 2025 to install EncystPHP, malware that maintains remote access and can initiate calls. Researchers assessed a connection to INJ3CTOR3, which previously targeted CVE-2019-19006.
- Made publicFixed
FreePBX published its CVE-2025-64328 advisory. Authenticated command injection affects Filestore versions from 17.0.2.36 up to, but excluding, 17.0.3; Filestore 17.0.3 fixes it.
- New fixFixed
Sangoma disclosed the administrator-interface vulnerability and released Framework fixes for FreePBX and PBXact: 13.0.197.14, 14.0.13.12 and 15.0.16.27.
Sources
- FreePBX Security Vulnerability SEC-2019-001Sangoma · 20 Nov 2019
- Authenticated Command Injection in FreePBX Administration GUIFreePBX · 5 Nov 2025
- Known Exploited Vulnerabilities catalogue — entries added 3 February 2026CISA · 3 Feb 2026
- Unveiling the Weaponized Web Shell EncystPHPFortiGuard Labs · 28 Jan 2026
- More than 900 IP addresses with compromised FreePBX systemsThe Shadowserver Foundation · 24 Feb 2026
- 900+ Sangoma FreePBX Instances Compromised in Ongoing Web Shell AttacksThe Hacker News · 27 Feb 2026