What is the CVSS score of CVE-2026-28209?

CVE-2026-28209 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of AI / ML are affected by CVE-2026-28209?

FreePBX installations versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4 contain a command injection vulnerability in the ElevenLabs text-to-speech module that could allow attackers to execute arbitrary…

How to fix or mitigate CVE-2026-28209?

Within 24 hours: Identify and inventory all FreePBX instances using ElevenLabs TTS integration and disable the feature immediately if not critical to operations. Within 7 days: Implement network segmentation to restrict FreePBX access and apply WAF rules to block suspicious input patterns; document alternative TTS solutions. Within 30 days: Monitor FreePBX security advisories for patch release (versions 16.0.20 and 17.0.5) and plan upgrade deployment; conduct audit of any recordings module access logs for suspicious activity.

AI / ML CVE-2026-28209

HIGH

OS Command Injection (CWE-78)

2026-03-05 security-advisories@github.com

Command Injection AI / ML Freepbx

7.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 05, 2026 - 19:16 nvd

HIGH 7.2

DescriptionGitHub Advisory

FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.

AnalysisAI

Unauthenticated command injection in FreePBX versions 16.0.17.2-16.0.19 and 17.0.2.4-17.0.4 via the ElevenLabs Text-to-Speech integration allows authenticated users with high privileges to execute arbitrary system commands. The vulnerability exists in the recordings module and affects all installations using the vulnerable TTS engine. No patch is currently available, leaving affected systems at risk of full system compromise.

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects the recordings component of Freepbx. FreePBX is an open source IP PBX. From versions 16.0.17.2 to before 16.0.20 and from version 17.0.2.4 to before 17.0.5, a command injection vulnerability exists in FreePBX when using the ElevenLabs Text-to-Speech (TTS) engine in the recordings module. This issue has been patched in versions 16.0.20 and 17.0.5.