CVE-2026-54674
FreePBX is an open source IP PBX
- Risk score
- 64/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.9%
- Published
- 28 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note that this is often mo…
- Affected
- Sangoma Freepbx before 16.0.39, 17.0.7
- Fix
- Upgrade Sangoma Freepbx to 16.0.39 or 17.0.7 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Story map
At a glance
Sangoma Freepbx: Amber, patch this week. FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note that this is often mo…
The flaws
- CVE-2026-54674: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
- CVE-2026-75600: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
- CVE-2026-54675: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
- CVE-2026-54708: FreePBX is an open source IP PBX (CVSS 8.8 · EPSS 1%)
The fix
Upgrade Sangoma Freepbx: 16.0.39 · 17.0.7 · 17.0.9 · 16.0.10 · 17.0.5 · 16.0.72 or later on your release line
Who is exposed: Sangoma Freepbx before 16.0.39, 17.0.7
Where it stands
- No known exploitation
Connects to
- Same weakness: OS command injection (CWE-78). 307 other warnings in 30 days
- Same product: Earlier Sangoma Freepbx warnings. 2 in the last 90 days
Why it is Amber
- CVSS 8.8 high
References
Original description
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted HTTP strings. Authenticated access to UCP is required. Note that this is often more common for less-privileged users to have UCP access vs. the Administrator Control Panel (ACP) access (which is usually FreePBX higher-level administrator accounts only). Insufficient sanitization of certain URL parameters utilized by UCP did not fully account for malicious strings in these fields. This could result in binaries being executed on the host server by carefully chaining commands. This issue has been patched in versions 16.0.39 and 17.0.7.
Last activity 28 Sep 2026. Patch Forecast updates every hour.