FreePBX — Cyber Threats, Attacks & Incidents

Related Threat Clusters

• Critical FreePBX Vulnerability Exposes User Portals to Attackers

  A critical vulnerability in FreePBX, tracked as CVE-2026-46376, allows unauthenticated attackers to access user portals via the User Control Panel (UCP). This flaw arises from hard-coded credentials in the userman…

  3 articles · Updated May 20, 2026
• INJ3CTOR3 Targets FreePBX Systems with JOMANGY Webshell and VoIP Toll Fraud

  A cyber campaign attributed to the threat actor INJ3CTOR3 is targeting FreePBX systems, deploying a new PHP webshell named JOMANGY. This operation utilizes a six-layer persistence mechanism to maintain control over…

  5 articles · Updated May 22, 2026
• Critical RCE Vulnerability in BeyondTrust Software Requires Immediate Patching

  BeyondTrust has issued a warning regarding a critical remote code execution (RCE) vulnerability in its Remote Support and Privileged Remote Access software. The flaw, tracked as CVE-2026-1731, allows unauthenticated…

  1059 articles · Updated February 9, 2026
• FreePBX Vulnerabilities Enable Remote Code Execution via Authentication Bypass

  FreePBX has addressed critical vulnerabilities in its Endpoint Manager module that allow for authentication bypass and remote code execution. Discovered by Horizon3.ai researchers, these vulnerabilities affect telephony…

  2 articles · Updated December 16, 2025
• Metasploit Updates Include Exploits for FreePBX, Cacti, and SmarterMail

  Metasploit has released seven new exploit modules targeting vulnerabilities in FreePBX, Cacti, and SmarterMail. The update includes critical remote code execution capabilities for Cacti and SmarterMail, enhancing tools…

  4 articles · Updated January 31, 2026
• Approximately 900 Sangoma FreePBX Systems Compromised via CVE-2025-64328

  Approximately 900 Sangoma FreePBX systems are compromised due to CVE-2025-64328, a command injection vulnerability. This bug was patched in version 17.0.3, but many systems remain unpatched and vulnerable to…

  1 article · Updated February 28, 2026
• 900 Sangoma FreePBX Instances Compromised by CVE-2025-64328 Exploitation

  Attackers exploited CVE-2025-64328, a command injection vulnerability, affecting 900 Sangoma FreePBX systems. The exploitation resulted in the installation of web shells, with hundreds of instances remaining compromised…

  5 articles · Updated March 1, 2026
• Attackers Exploit FreePBX Vulnerability to Deploy EncystPHP Webshell

  Hackers are exploiting a critical vulnerability in FreePBX, specifically CVE-2025-64328, to deploy a persistent webshell named EncystPHP. This attack, attributed to the group INJ3CTOR3, allows complete administrative…

  2 articles · Updated January 29, 2026

Recent Intelligence Reports

• Hackers Use Six — Cybersecuritynews · May 22, 2026
• Hackers Use Six-Layer Persistence on FreePBX Systems — Gbhackers · May 22, 2026
• Hackers Use Six — Gbhackers · May 22, 2026
• INJ3CTOR3 Deploys JOMANGY Webshell in Advanced FreePBX Attacks — Thecyberexpress · May 22, 2026
• CISA Warns Trend Micro Apex One Vulnerability Is Being Exploited in Attacks — Gbhackers · May 22, 2026
• FreePBX Vulnerability Allow Attackers to Gain Access to User Portals — Cybersecuritynews · May 20, 2026
• FreePBX Security Flaw Lets Attackers Access User Portals — Gbhackers · May 20, 2026
• Ongoing Cyberattack Exploits Sangoma FreePBX CVE-2025-64328: Over 900 Instances ... — Rescana · March 1, 2026

Related Entities