Skip to content
OpenAdvisories

Product · FreePBX

ucp

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Critical 9.3
    CVE-2026-73665 Public exploit

    FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection

    FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to…

    FreePBX ucp