FreePBX, the widely deployed open-source web-based GUI for managing Asterisk-based VoIP PBX systems, has patched three new vulnerabilities covering SQL injection in two modules and command injection across multiple endpoints. The issues affect both the 16.x and 17.x branches and are addressed in versions 16.0.49 / 17.0.7 (for the CDR module), 16.0.10 / 17.0.5 (for the logfiles module), and 16.0.20 / 17.0.5 (for command injection). VoIP infrastructure is a perennially high-value target for attackers, and FreePBX systems are frequently internet-exposed with outdated patch levels in SMB and enterprise environments alike.
CVE-2026-28210: SQL Injection in the CDR Module
CVE-2026-28210 is an SQL injection vulnerability in the FreePBX CDR (Call Data Record) module, affecting versions prior to 16.0.49 and 17.0.7. The CDR module handles the storage and retrieval of call records, making it a data-rich target. Successful exploitation could allow an attacker to read, modify, or delete call data records, enumerate the database schema, and potentially escalate to further system compromise depending on database user privileges and configuration.
CVE-2026-28284: Multiple Authenticated SQL Injections in the Logfiles Module
CVE-2026-28284 documents several authenticated SQL injection vulnerabilities in the FreePBX logfiles module, affecting versions prior to 16.0.10 and 17.0.5. The authenticated requirement limits the exposure surface compared to an unauthenticated flaw, but FreePBX administrative credentials are frequently weak or default in SMB deployments, and prior FreePBX vulnerabilities including authentication bypass issues (notably CVE-2025-66039, patched in December 2025) mean that authentication cannot be assumed to be a reliable barrier on unpatched instances.
CVE-2026-28287: Multiple Command Injection Vulnerabilities
CVE-2026-28287 is the most severe of the three. Multiple command injection vulnerabilities exist in versions 16.0.17.2 through 16.0.20 and 17.0.2.4 through 17.0.5. Command injection in a PBX management interface typically translates directly to remote code execution on the underlying Linux host, as FreePBX runs with significant system-level privileges to manage telephony hardware and services. Successful exploitation could yield full system compromise of the PBX host.
Context: FreePBX as a Recurring Target
FreePBX has a sustained history of significant vulnerabilities. The December 2025 patch cycle addressed CVE-2025-66039 (authentication bypass), CVE-2025-61675 (authenticated SQLi), and CVE-2025-61678 (authenticated arbitrary file upload leading to RCE), with Horizon3.ai demonstrating that the authentication bypass could be chained with the SQLi and file upload issues to achieve unauthenticated RCE. The newly patched CVEs follow the same pattern. Organizations running internet-exposed FreePBX instances without current patches should assume a high risk of compromise. Default or weak administrative credentials compound this risk significantly.
Remediation
Update to the following fixed versions via the FreePBX Module Admin interface or CLI: CDR module to 16.0.49 or 17.0.7, logfiles module to 16.0.10 or 17.0.5, and apply the 16.0.20 or 17.0.5 release addressing command injection. Organizations should also ensure the FreePBX administrative interface is not directly accessible from the public internet, rotate administrative credentials, and review logs for prior exploitation indicators including unexpected database queries and unusual system command execution in PBX logs.
This article is published for threat intelligence purposes. IntelFusions is not affiliated with any threat actor group. Claims described herein have not been independently verified unless explicitly stated.