Is CVE-2025-64328 (Sangoma FreePBX OS Command Injection) being exploited in the wild?

Yes. CISA added CVE-2025-64328 to its Known Exploited Vulnerabilities catalogue on 3 February 2026, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function.

How to confirm whether CVE-2025-64328 is being exploited in the wild

For a CVE like this, the practical question is not whether exploitation is theoretically possible, but whether your FreePBX Endpoint Manager deployment is exposed to the vulnerable command path and whether logs, alerts, or external reporting suggest active probing or post-authentication abuse. CISA’s KEV listing is the strongest public signal that real-world exploitation has been observed.

Because the vulnerable path is tied to an authenticated workflow, confirm whether any administrative or operator accounts can reach the Endpoint Manager function involved in the command injection chain. Then review command execution traces, authentication logs, and unusual SSH-related activity around the affected component, especially if the system is internet-reachable or used by multiple administrators.

Independent confirmation matters because “exploited in the wild” can mean different things operationally: public proof of exploitation, opportunistic scanning, or targeted abuse against a small set of exposed systems. Treat KEV inclusion as a prioritisation trigger, then validate whether your own environment shows the indicators that would justify emergency response rather than routine patch scheduling.

What the vulnerability means for FreePBX deployments

This issue is an OS command injection problem in a management function, which makes it especially dangerous because a successful request can move from application input handling to operating-system command execution. In practice, that means the exposed surface is not just the web interface, but the underlying host and any trust placed in the management path.

The fact that the issue is described as post-authentication changes the defensive focus. You are not only checking for anonymous internet scanning, you are checking whether valid credentials, overbroad administrative access, or exposed management endpoints let a legitimate user trigger unsafe command construction. That is why exposure review, privilege review, and log review belong together.

For broad remediation planning, use the vendor advisory and the CISA KEV catalogue for version-specific instructions instead of relying on secondary summaries. The vendor page should tell you exactly what to upgrade or mitigate, while KEV tells you why the issue should be treated as an active exploitation priority rather than a routine vulnerability.

What to do if you cannot patch immediately

If patching must wait, reduce the reachable attack surface first. Restrict access to the Endpoint Manager interface to trusted administrative networks, remove unnecessary administrative accounts, and verify that only the minimum operators can reach the function implicated in the injection path. The goal is to narrow both network exposure and authenticated reachability.

At the same time, collect evidence that would help you distinguish benign use from abuse. Preserve relevant web, application, authentication, and host command logs; review for repeated failed logins followed by unusual command execution; and look for SSH or process activity that does not fit ordinary endpoint management behaviour. If you find signs of compromise, rotate any credentials or keys that may have been accessible through the affected administration path.

When a management plane flaw is already in KEV, a delay is acceptable only if you can demonstrate compensating controls and an explicit remediation timeline. Otherwise, treat the system as a high-priority exception rather than a standard backlog item.

Risk and Threat Considerations

The main risk is that an authenticated command injection in an administrative component can turn routine management access into host-level execution. That creates a short path from account compromise or overprivileged access to system compromise, persistence, or lateral movement if the FreePBX host sits in a broader trusted network.

Failure mechanism: An attacker or malicious user reaches the vulnerable check path through a valid session, injects operating-system commands, and uses the resulting execution context to run arbitrary actions on the host.

Impact: The exposed system may allow configuration tampering, service disruption, credential theft, or follow-on access to adjacent systems that trust the FreePBX server.

Framework Alignment

CISA Known Exploited Vulnerabilities Catalog: Use the KEV listing to triage this issue as actively exploited and prioritize remediation accordingly.
NIST National Vulnerability Database: Use the CVE record to verify the official description and track product-level vulnerability metadata.
Web Application Attacks Guide: Use this to map the issue to command injection patterns and review related exploitation and defense mechanics.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1059 — Command and Scripting Interpreter	OS command injection maps to attacker-run command execution on the host.
Recommendation — Map observed payloads to T1059 and hunt for spawned shells or suspicious subprocesses.
CIS Controls v8	CIS-6 — Access Control Management	Post-authentication abuse depends on controlling who can reach the management function.
Recommendation — Restrict administrative access paths and remove unnecessary operator accounts.
OWASP ASVS	V8 — Authorization	The flaw matters because authenticated users can trigger unsafe privileged behaviour.
Recommendation — Verify that privileged functions enforce strict authorization before invoking system actions.
NIST SP 800-53 Rev 5	IA-5 — Authenticator Management	Credential hygiene matters when authenticated access can reach the vulnerable path.
Recommendation — Rotate or retire exposed credentials and credentials tied to suspicious admin activity.

Practitioner Guidance

What to verify: Confirm whether the vulnerable Endpoint Manager function is reachable from any administrative network segment, whether exposed accounts are still active, and whether your logs show command-like input patterns or unexpected subprocess creation around the relevant timeframe.

Decision rule: If you cannot patch immediately, prioritize containment and evidence preservation over broad changes. If you do patch, validate that access to the management interface is still tightly restricted and that no residual suspicious activity appeared before the fix.

Common mistake: Treating a post-authentication flaw as “low risk” because it is not anonymous. In a management plane, authenticated abuse can still be enough to compromise the host, so exposure and privilege matter as much as exploitability.

Practitioner takeaway: For KEV-listed management-plane flaws, the right question is not simply whether exploitation exists, but whether your environment still gives that exploitation a usable path.