Loading story…
The Canadian Centre for Cyber Security issued advisory AV26-818 warning that multiple FreePBX components contain vulnerabilities requiring immediate updates. Affected modules include backup, framework, missedcall, music, tts, and ucp across FreePBX 16 and 17 branches, with the notice directing administrators to review FreePBX's published security advisories and apply patched releases.
The most severe flaws include CVE-2026-73665, an unauthenticated remote code execution bug in UCP caused by a Socket.IO namespace authentication bypass and AMI action injection, fixed in UCP 17.0.9, and CVE-2026-73663, an unauthenticated SQL injection in missedcall via inbound Caller ID name that can enable administrator takeover, fixed in missedcall 16.0.11 and 17.0.4. Additional high-severity issues include CVE-2026-73664 in the Backup module, which can inject an SSH key into authorized_keys for persistent shell access and is fixed in Backup 17.0.11, and CVE-2026-73661 in the Framework module, where a crafted backup can restore AUTHTYPE=none and weaken authentication, fixed in Framework 16.0.47 and 17.0.30.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
On August 14, 2026, the Canadian Centre for Cyber Security published security notice AV26-818 covering multiple FreePBX vulnerabilities and urging users to review vendor guidance and apply updates.
The Canadian Centre for Cyber Security stated that as of August 13, 2026, multiple FreePBX modules were affected, including backup, framework, missedcall, music, tts, and ucp. The notice identified impacted version ranges across FreePBX 16 and 17 branches and directed administrators to FreePBX advisories for remediation.
On August 13, 2026, GitHub Security Advisories received CVE records for FreePBX vulnerabilities affecting Backup, Framework, UCP, and missedcall. The records correspond to CVE-2026-73664, CVE-2026-73661, CVE-2026-73665, and CVE-2026-73663.
On July 16, 2026, FreePBX published five GitHub security advisories covering a critical unauthenticated UCP remote code execution flaw, a critical unauthenticated missedcall SQL injection flaw, and high-severity issues in TTS, Framework, and Music.
On July 9, 2026, FreePBX published GitHub security advisories for an API generatedocs host command injection flaw and an authenticated arbitrary SSH key injection issue in the Backup module.
On June 12, 2026, FreePBX published GitHub security advisories for Superfecta arbitrary PHP code execution, Backup module path traversal remote code execution, and Soundlang remote code execution via file upload and convert.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
7 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FreePBX patched three serious vulnerabilities in the Endpoint Manager component that can be chained to give an attacker control of a vulnerable system. The issues include **CVE-2025-66039**, a critical authentication bypass tied to manipulation of the `Authorization` header to use the `webserver` authentication type, plus **CVE-2025-61675** and **CVE-2025-61678`, two high-severity flaws that enable SQL injection and arbitrary file upload. Researchers reported that, when combined, the bugs can let an unauthenticated attacker read and modify SQL database contents and upload files such as webshells, leading to remote code execution. The vulnerabilities affect FreePBX 16 before **16.0.44** and **16.0.92**, and FreePBX 17 before **17.0.6** and **17.0.23**. Reporting indicates the authentication bypass is not exploitable in a standard FreePBX configuration, but organizations with affected deployments were urged to update immediately and apply configuration mitigations where relevant. The disclosures highlight the risk of exposed PBX management components, particularly where Endpoint Manager is enabled and reachable by attackers.
Jul 24, 2026
FreePBX remediated **CVE-2025-57819**, an insufficient input-validation vulnerability affecting FreePBX versions 15, 16, and 17. The flaw can let an attacker gain unauthorized access and potentially execute arbitrary code on affected PBX systems. FreePBX reported active exploitation against multiple version 16 and 17 deployments with internet-exposed management interfaces, particularly where IP filtering and access-control lists (ACLs) were inadequate. Organizations should apply the vendor security updates, confirm the Endpoint module is at the required patched version, restrict administrator interfaces to trusted networks, and investigate exposed systems using FreePBX-provided indicators of compromise.
Aug 31, 2026
FreePBX, the open-source IP PBX platform, has patched several critical vulnerabilities in its Endpoint Manager module that could allow attackers to bypass authentication and achieve remote code execution. Researchers from Horizon3.ai identified three high-severity flaws: CVE-2025-66039 (authentication bypass via forged Basic Auth headers when 'webserver' authorization is enabled), CVE-2025-61675 (multiple SQL injection vulnerabilities across several endpoints), and CVE-2025-61678 (arbitrary file upload enabling PHP webshell deployment). These vulnerabilities, when chained, allow unauthenticated attackers to gain full control over affected FreePBX instances, posing a significant risk to business communications infrastructure. The authentication bypass is not present in the default configuration but becomes exploitable if certain advanced settings are enabled. Attackers can exploit these flaws to access protected endpoints, manipulate the underlying SQL database, and upload malicious files for command execution. The vulnerabilities were responsibly disclosed to FreePBX maintainers, and patches have been released. Organizations using FreePBX, especially those with non-default authentication settings, are urged to update immediately to mitigate the risk of compromise.
Jun 29, 2026