en
FreePBX is an open-source, web-based IP PBX management platform for Asterisk, maintained primarily by Sangoma with contributions from a wider community. It provides modular tools for configuring business telephony and unified communications, and is deployed by organizations and operators in varied environments worldwide.
As of 09/20/2026, FreePBX recorded 7 security vulnerabilities in the last 90 days across 7 products, including 7 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, backup had the most security vulnerabilities in the FreePBX ecosystem, with 1 vulnerabilities—approximately 14.29% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-73665FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection | Exploitation statusNot known exploited | FixYes | Affected productucp | Published08/13/2026 | SeverityCritical |
CVE-2026-73664FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module | Exploitation statusNot known exploited | FixYes | Affected productbackup | Published08/13/2026 | SeverityHigh |
CVE-2026-73663FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover | Exploitation statusNot known exploited | FixYes | Affected productmissedcall | Published08/13/2026 | SeverityCritical |
CVE-2026-73662Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files | Exploitation statusNot known exploited | FixYes | Affected productmusic | Published08/13/2026 | SeverityHigh |
CVE-2026-73661FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup | Exploitation statusNot known exploited | FixYes | Affected productframework | Published08/13/2026 | SeverityHigh |
CVE-2026-73660FreePBX: Authenticated TTS AGI Command Injection Through TTS Name | Exploitation statusNot known exploited | FixYes | Affected producttts | Published08/13/2026 | SeverityHigh |
CVE-2026-72578FreePBX Framework - Missing CSRF Protection in Admin Panel Ajax Dispatcher | Exploitation statusNot known exploited | FixNot confirmed | Affected productFreePBX Framework | Published08/10/2026 | SeverityHigh |
CVE-2026-44237FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published05/29/2026 | SeverityHigh |
CVE-2026-44238FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published05/29/2026 | SeverityHigh |
CVE-2026-44239FreePBX: Authenticated Local File Inclusion in Dashboard Module | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published05/29/2026 | SeverityHigh |
CVE-2026-46376FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published05/29/2026 | SeverityCritical |
CVE-2026-26978Free PBX backup: Deserialization of Untrusted Data in admin/modules/backup/Models/BackupSplFileInfo.php | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published05/18/2026 | SeverityHigh |
CVE-2026-40520FreePBX api module Command Injection via GraphQL | Exploitation statusNot known exploited | FixYes | Affected productapi | Published04/21/2026 | SeverityHigh |
CVE-2026-28287FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published03/05/2026 | SeverityHigh |
CVE-2026-28284FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published03/05/2026 | SeverityHigh |
CVE-2026-28210FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published03/05/2026 | SeverityHigh |
CVE-2026-28209FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published03/05/2026 | SeverityHigh |
CVE-2025-55210FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes | Exploitation statusNot known exploited | FixYes | Affected productapi | Published02/12/2026 | SeverityLow |
CVE-2025-67736Authenticated SQL Injection in FreePBX tts (Text To Speech) module | Exploitation statusNot known exploited | FixNot confirmed | Affected producttts | Published12/16/2025 | SeverityHigh |
CVE-2025-67722Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation | Exploitation statusNot known exploited | FixNot confirmed | Affected productframework | Published12/16/2025 | SeverityMedium |
CVE-2024-58294FreePBX 16 Authenticated Remote Code Execution via API Module | Exploitation statusPublic exploit | FixNot confirmed | Affected productFreePBX | Published12/11/2025 | SeverityHigh |
CVE-2025-67513FreePBX Endpoint Manager's Weak Default Password Allows Unauthenticated Access in Endpoint Module REST API | Exploitation statusNot known exploited | FixYes | Affected productendpoint | Published12/10/2025 | SeverityMedium |
CVE-2025-66039FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header | Exploitation statusNot known exploited | FixYes | Affected productframework | Published12/09/2025 | SeverityCritical |
CVE-2025-62173Authenticated SQL Injection in Endpoint Module Rest API | Exploitation statusNot known exploited | FixNot confirmed | Affected productrestapps | Published12/03/2025 | SeverityHigh |
CVE-2025-64328FreePBX Administration GUI is Vulnerable to Authenticated Command Injection | Exploitation statusKEV | FixYes | Affected productfilestore | Published11/07/2025 | SeverityHigh |
CVE-2025-61678FreePBX Endpoint Manager vulnerable to authenticated arbitrary file upload via fwbrand parameter | Exploitation statusNot known exploited | FixYes | Affected productendpointman | Published10/14/2025 | SeverityHigh |
CVE-2025-61675FreePBX Endpoint Manager vulnerable to authenticated SQL injection in multiple configuration parameters | Exploitation statusNot known exploited | FixYes | Affected productendpoint | Published10/14/2025 | SeverityHigh |
CVE-2025-59429FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page | Exploitation statusPublic exploit | FixYes | Affected productcore | Published10/14/2025 | SeverityHigh |
CVE-2025-59051FreePBX Endpoint Manager command injection via Network Scanning feature | Exploitation statusNot known exploited | FixNot confirmed | Affected productendpoint | Published10/14/2025 | SeverityHigh |
CVE-2025-59056FreePBX vulnerable to unauthenticated Denial of Service | Exploitation statusNot known exploited | FixYes | Affected productframework | Published09/15/2025 | SeverityMedium |
CVE-2025-55211FreePBX Post-Authenticated Command Injection | Exploitation statusNot known exploited | FixYes | Affected productframework | Published09/15/2025 | SeverityMedium |
CVE-2025-55739api: Shared OAuth Signing Key Between Different Instances | Exploitation statusNot known exploited | FixYes | Affected productapi | Published09/04/2025 | SeverityMedium |
CVE-2025-55209FreePBX UCP is Vulnerable to Stored XSS Through its User Control Panel | Exploitation statusNot known exploited | FixYes | Affected productcontactmanager | Published09/04/2025 | SeverityMedium |
CVE-2025-57819FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE | Exploitation statusKEV | FixYes | Affected productendpoint | Published08/28/2025 | SeverityCritical |
CVE-2024-47071OSS Endpoint Manager allows unauthorized access to read system files | Exploitation statusPublic exploit | FixYes | Affected productendpointman | Published10/01/2024 | SeverityMedium |
CVE-2019-25090FreePBX arimanager Views cross site scripting | Exploitation statusNot confirmed | FixYes | Affected productarimanager | Published12/27/2022 | SeverityLow |
CVE-2021-4282FreePBX voicemail page.voicemail.php cross site scripting | Exploitation statusNot confirmed | FixYes | Affected productvoicemail | Published12/27/2022 | SeverityLow |
CVE-2020-36630FreePBX cdr Cdr.class.php ajaxHandler sql injection | Exploitation statusNot confirmed | FixYes | Affected productcdr | Published12/25/2022 | SeverityMedium |
CVE-2019-16967 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2019 | SeverityUnknown |
CVE-2019-16966 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2019 | SeverityUnknown |
CVE-2018-15891 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/20/2019 | SeverityUnknown |
CVE-2018-15892 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/20/2019 | SeverityUnknown |
CVE-2014-7235 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published10/07/2014 | SeverityUnknown |
CVE-2014-1903 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2014 | SeverityUnknown |
CVE-2009-4458 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/30/2009 | SeverityUnknown |
CVE-2009-1801 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/28/2009 | SeverityUnknown |
CVE-2009-1802 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/28/2009 | SeverityUnknown |
CVE-2009-1803 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/28/2009 | SeverityUnknown |
CVE-2007-2350 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/30/2007 | SeverityUnknown |
CVE-2007-2191 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/24/2007 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
