CVE-2026-45562
FreePBX is an open source IP PBX
- Risk score
- 49/100
- CVSS
- 7.2 v3.1
- Exploit chance (30 days)
- 0.4%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreePBX administrator acc…
- Affected
- Sangoma Freepbx before 16.0.4, 17.0.6
- Fix
- Upgrade Sangoma Freepbx to 16.0.4 or 17.0.6 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Story map
At a glance
Sangoma Freepbx: Amber, patch this week. FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note that this is often mo…
The flaws
- CVE-2026-45562: FreePBX is an open source IP PBX (CVSS 7.2 · EPSS 0%)
- CVE-2026-54674: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
- CVE-2026-75600: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
- CVE-2026-54675: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
The fix
Upgrade Sangoma Freepbx: 16.0.4 · 17.0.6 · 16.0.39 · 17.0.7 · 17.0.9 · 16.0.10 or later on your release line
Who is exposed: Sangoma Freepbx before 16.0.39, 17.0.7
Where it stands
- No known exploitation
Connects to
- Same weakness: OS command injection (CWE-78). 306 other warnings in 30 days
- Same product: Earlier Sangoma Freepbx warnings. 2 in the last 90 days
Why it is Yellow
- CVSS 7.2 high
References
Original description
FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges of the Asterisk service. Authentication with an existing FreePBX administrator account is required. The root cause lies in the fact that the module accepts a POST parameter that defines a custom Asterisk application, which is then stored in the database without any sanitization. Later, this data is written directly to the musiconhold_additional.conf configuration file without validation. Since Asterisk reads this configuration file and executes the specified application, an attacker can inject arbitrary commands that will be executed with Asterisk's permissions. This issue has been patched in versions 16.0.4 and 17.0.6.
Last activity 28 Sep 2026. Patch Forecast updates every hour.