ThreatCluster

Critical FreePBX Vulnerability Exposes User Portals to Attackers

First seen 20 May 2026, 14:43 UTC •GbhackersCybersecuritynewsCcb.Belgium.Be •88% similarity •73

Article Content

Browse articles
ThreatCluster

A critical vulnerability in FreePBX, tracked as CVE-2026-46376, allows unauthenticated attackers to access user portals via the User Control Panel (UCP). This flaw arises from hard-coded credentials in the userman module and affects FreePBX versions prior to 16.0.45 and 17.0.7. Systems running outdated versions are particularly at risk. The vulnerability has a CVSS v4 base score of 9.1, indicating its severity. Administrators are urged to update their systems to mitigate the risk. The issue was disclosed on May 20, 2026, with no reports of active exploitation at this time.

Key Points: • CVE-2026-46376 allows unauthenticated access to FreePBX user portals. • The vulnerability affects FreePBX versions before 16.0.45 and 17.0.7. • Administrators are advised to upgrade systems to prevent potential exploitation.

ThreatCluster AI

Timeline

2026-05-20
CVE-2026-46376 disclosed
A critical vulnerability in FreePBX was identified, allowing unauthorized access to user portals.
Cybersecuritynews
2026-05-20
CVE-2026-46376 reported by multiple sources
The flaw was reported across various cybersecurity platforms, highlighting its critical nature and impact.
Gbhackers

Extracted Entities

1 / 2

Community

Browse all →

Tracked Entities in This Story

FreePBX Data Breach