Two additional Sangoma FreePBX vulnerabilities were confirmed exploited and added to CISA's KEV catalogue on the same day — one a 2025 command injection bug in the Endpoint Manager module, the other a 2019 authentication bypass that took more than six years to resurface as confirmed exploitation. This is separate from other Sangoma FreePBX coverage published elsewhere in this series; these are additional, distinct findings against the same platform rather than a duplicate.
| CVE | CVSS | Issue | Originally Disclosed | Added to KEV |
|---|---|---|---|---|
| CVE-2025-64328 | 7.2 | OS command injection in Endpoint Manager's SSH connection test | 2025 | 3 Feb 2026 |
| CVE-2019-19006 | 9.8 | Improper authentication allowing admin password bypass | 2019 | 3 Feb 2026 |
Why a six-year-old FreePBX bug and a brand-new one landed in KEV together
Both CVEs were added to CISA's KEV catalogue on the exact same date, despite an original disclosure gap of roughly six years between them. That is not a coincidence of timing — it strongly suggests both were confirmed exploited as part of the same wave of attacker activity against FreePBX deployments, likely because both provide complementary value to an intruder targeting the same target population: internet-facing PBX/VoIP administration panels that are frequently deployed once and left unmaintained for years. CVE-2019-19006 gives an attacker a path to bypass password authentication and reach FreePBX admin services outright. CVE-2025-64328 then gives a different, already-authenticated attacker (or the same one, having used the 2019 bug to get there) a path to full remote command execution as the asterisk user, via a command injection flaw in how the Endpoint Manager module's filestore driver tests an SSH connection. Chained together, an unauthenticated actor can plausibly move from zero access to remote code execution using two bugs published six years apart against the same product family.
Why "post-authentication" doesn't mean "low priority" here
NVD's description of CVE-2025-64328 is explicit that exploitation requires an "authenticated known user" — normally language that tempers urgency, since post-auth bugs require an attacker to already hold valid credentials. But that qualifier means something different when the same product line has a public, well-documented, six-year-old authentication bypass sitting in the same KEV batch. The command injection lives specifically in the testconnection -> check_ssh_connect() function within the filestore module's SSH driver, a narrow and specific code path that the FreePBX security advisory and GitHub reference material describe in detail — precise enough that Fortra's own threat research team published analysis titled around a "weaponized web shell" connected to this vulnerability family, indicating the post-authentication requirement was not a meaningful barrier in observed attacks.
What to check this week
- Patch FreePBX Endpoint Manager to version 17.0.3 or later, which Sangoma's security advisory identifies as the fix for the command injection vulnerability.
- Verify no FreePBX instance is still running a version vulnerable to the 2019 authentication bypass — a six-year publication gap does not mean the underlying bug was quietly fixed everywhere; unmaintained or unpatched legacy installs remain exposed to both flaws simultaneously.
- Audit which accounts have access to the Endpoint Manager filestore module's SSH connection-test feature specifically, since that narrow feature is the entire attack surface for the command injection bug.
- Treat any internet-facing FreePBX administration panel as a priority patch target regardless of apparent age, given that this KEV batch demonstrates old and new vulnerabilities in the same product being weaponized together.
A closing note on PBX systems as a persistently under-patched category
VoIP and PBX administration systems like FreePBX often get deployed by smaller organizations or managed service providers as a one-time setup with limited ongoing security review, compared to the sustained patch cadence applied to core network infrastructure or endpoint security tools. That operational pattern is precisely why a 2019 authentication bypass can still be confirmed under active exploitation in 2026 — the deployment base simply never fully migrated off the vulnerable versions, giving attackers a durable target population that doesn't shrink the way it would for more actively maintained software categories.
A final consideration on cross-referencing old and new CVEs against the same product
Security teams that track vulnerability management by CVE age or publication recency risk deprioritizing exactly the kind of finding described here — a 2019 bug that only becomes urgent again once paired with a fresh 2025 companion vulnerability against the same product. Asset owners running FreePBX should treat the full historical CVE list for the product as a single ongoing patch surface, not a queue where older entries age out of relevance.
How Safeguard helps
Safeguard's continuous inventory tracks FreePBX and Endpoint Manager deployments against the complete, ongoing CVE history for the product rather than only the most recently disclosed entry, so a years-old authentication bypass and a newly confirmed command injection bug against the same platform are surfaced together as the compounding risk they represent.
