CVE-2025-64328 exploitation impacts 900 Sangoma FreePBX instances

Back Securityaffairs

CVE-2025-64328 exploitation impacts 900 Sangoma FreePBX instances

Securityaffairs • March 1, 2026

Share: View original

900 Sangoma FreePBX systems were infected with web shells after attackers exploited a command injection flaw .

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

900 Sangoma FreePBX Instances Compromised by CVE-2025-64328 Exploitation Attackers exploited CVE-2025-64328, a command injection vulnerability, affecting 900 Sangoma FreePBX systems. The exploitation resulted in the installation of web shells, with hundreds of instances remaining compromised since attacks began in December 2025. 5 sources 36

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

MITRE ATT&CK (1)

T1505.003 - Web Shell

Platforms (1)