Are phone systems (3CX, Mitel, Avaya, FreePBX) safe right now?
No phone system flaws have been added to CISA's exploited list in the last 90 days (the most recent was Feb 3, 2026). Keep automatic updates on: that can change any day.
Earlier exploited flaws
- Sangoma FreePBX OS Command Injection Vulnerability
- Sangoma FreePBX Improper Authentication Vulnerability
- Sangoma FreePBX Authentication Bypass Vulnerability Zero-day
- Mitel SIP Phones Argument Injection Vulnerability
- Mitel MiCollab Path Traversal Vulnerability
- Mitel MiCollab Path Traversal Vulnerability
- Mitel MiVoice Connect Code Injection Vulnerability
- Mitel MiVoice Connect Command Injection Vulnerability
- Mitel MiVoice Connect Data Validation Vulnerability
- MiCollab, MiVoice Business Express Access Control Vulnerability
By year
| Year | Exploited flaws added | Zero-days |
|---|---|---|
| 2026 (so far) | 2 | 0 |
| 2025 | 4 | 1 |
| 2024 | 0 | 0 |
| 2023 | 2 | 0 |
| 2022 | 2 | 0 |
Questions
Are phone systems (3CX, Mitel, Avaya, FreePBX) safe right now?
No phone system flaws have been added to CISA's exploited list in the last 90 days (the most recent was Feb 3, 2026). Keep automatic updates on: that can change any day. Confirm with the vendor's own advisories and install updates as soon as they're available.
How many phone systems vulnerabilities have been exploited?
10 flaws are on CISA's list of vulnerabilities known to be exploited in real attacks, 5 of them used by ransomware.
Covers products matching 3cx, mitel, avaya, freepbx. Sources: CISA's Known Exploited Vulnerabilities catalog and the vendors' own advisories. Updated every hour. General information only; confirm details with the vendor.