Vulnerability Intelligence Report
FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints
CVE-2026-28287
FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, multiple command injection vulnerabilities exist in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.
No Active Exploit Signals
CVSS Base Score
8.6
HIGH
EPSS Probability:8.49%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-78 ↗CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| FreePBX | security-reporting | >= 16.0.17.2, < 16.0.20 (affected), >= 17.0.2.4, < 17.0.5 (affected) |
Threat Intelligence Signals
EPSS Score
8.493%
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | GitHub, Inc. · Vendor · USA |
| Reserved | 2026-02-26T01:52:58 |
| Published | 2026-03-05T18:25:54 |
| Last Updated | 2026-03-09T13:47:27 |
Community Chatter & Buzz