External risk intelligence

FreePBX UCP Node Arbitrary Command Execution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-73665

FreePBX is a telephony management system often exposed to the internet to allow remote VoIP connections and management. The vulnerability exists in the User Control Panel (UCP) node server, a component designed for user access, which is commonly exposed to facilitate remote administration and end-user telephony services.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in FreePBX's User Control Panel (UCP) Node server, which could allow unauthenticated attackers to execute arbitrary commands on affected systems. The issue arises from how certain network connections are authenticated, potentially enabling malicious actors to leverage the Asterisk Manager Interface. The primary concern for leadership is to understand the potential exposure of their FreePBX environments and to verify if their systems are running the vulnerable versions.

Unauthenticated command execution in FreePBX.
Widespread use of FreePBX in business communications.
Assess FreePBX for potential command execution risk.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by connecting to custom namespaces within the UCP Node server. These namespaces bypass the intended authentication checks, allowing the attacker to send specially crafted event data. This data can contain characters that manipulate the Asterisk Manager Interface, leading to the execution of arbitrary commands with the privileges of the asterisk service user.

No authentication is required to access the vulnerability.
Crafted event data sent to custom namespaces triggers the issue.
Risk includes arbitrary command execution as a service user.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to execute arbitrary commands on a FreePBX system by sending crafted data to custom namespaces within the UCP Node server. This could affect the integrity and availability of the system.

System commands executed as asterisk user.
Unauthenticated network connection to custom namespaces.
Compromised system and service availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in FreePBX's UCP Node server impacts systems that are likely exposed to the internet for remote VoIP and management access. The first practical step is to identify all FreePBX instances, confirm their exposure and business criticality, and then engage the responsible teams—likely application or platform owners, in coordination with security and network teams—to plan remediation.

Application or platform teams should own.
Verify UCP exposure and reachability.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreePBX?

FreePBX is an open-source IP PBX software used to manage and configure telephony systems. It handles voice-over-IP (VoIP) communications for businesses, acting as a central hub for call routing and management features. The User Control Panel (UCP) is a specific component that provides end-users with a web interface to manage their personal telephony settings, extensions, and call history.

What does CWE-862 mean for CVE-2026-73665?

CWE-862 is a weakness class known as Missing Authorization. In the context of this vulnerability, it means the software fails to properly check if a user is allowed to perform a specific action. Because the UCP Node server does not consistently apply authentication middleware to custom network namespaces, an attacker can bypass access controls that would normally prevent unauthorized users from interacting with sensitive internal interfaces.

How does an attacker trigger this vulnerability?

An attacker triggers the bug by connecting to custom namespaces within the UCP Node server that lack proper authentication. Once connected, they send specifically crafted event data containing newline or carriage-return characters. This input manipulates the Asterisk Manager Interface, tricking it into executing commands. Note that standard connections to the default namespace are protected by existing security checks and do not trigger this specific issue.

Is my FreePBX system at risk?

If your FreePBX instance is reachable from the internet, Halo Surface Signal identifies it as having a higher likelihood of being targeted. This is because the UCP Node server is often deliberately exposed to support remote VoIP connections and off-site management. Systems running versions prior to 17.0.9 are susceptible to this unauthenticated command execution flaw, regardless of whether they are on a private or public network.

How should I respond to this threat?

The most effective response is to update your FreePBX installation to version 17.0.9 or later, which contains the necessary security patches. Before applying the update, identify all instances of FreePBX in your environment to understand your total footprint. Coordinate with the teams responsible for your telephony infrastructure to ensure the update is deployed effectively and to verify that the UCP Node server is no longer accessible to unauthorized parties.

References

github.com/FreePBX/security-reporting/security/advisories/GHSA-3…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.