F
Vendor security profile3 actively exploited CVEs
freepbx
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs26
Critical5
CISA KEV3
Public exploit4
Patch rate%15
Avg. CVSS8.5
12-month vulnerability rate
0
3
0
2
0
1
4
0
0
7
6
0
CVE KEV
CVE severity distribution
26toplam CVE
Critical5 (19%)
High18 (69%)
Medium1 (4%)
Uncertain2 (8%)
Patch and exploitation view
%15
Verified patch
%12
CISA KEV
%15
Public exploit
4Patch available
0Partial
3Workaround
0Vendor: no patch
19Unknown
Latest vulnerabilities
8.6
CVE-2026-75600
FreePBX: Authenticated API generatedocs Host Command Injection
F
Patch status unknownEPSS %1
8.6
CVE-2026-54710
FreePBX: Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)
F
Patch status unknownEPSS %0
8.6
CVE-2026-54708
Authenticated Remote Code Execution via Path Traversal in FreePBX Backup Module
F
Patch status unknownEPSS %0
8.7
CVE-2026-54675
FreePBX: Authenticated Remote Code Execution via File Upload and Convert in Soundlang Module
F
Patch status unknownEPSS %1
8.6
CVE-2026-54674
Authenticated Command Injection in FreePBX UCP Interface
F
Patch status unknownEPSS %1
7.7
CVE-2026-45562
FreePBX: Authenticated Remote Code Execution in FreePBX Music on Hold (MoH) Module
F
Patch status unknownEPSS %0
9.3
CVE-2026-73665
FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
F
Patch status unknownEPSS %0
8.6
CVE-2026-73664
FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module
F
Patch status unknownEPSS %1
9.3
CVE-2026-73663
FreePBX: Unauthenticated SQL injection in FreePBX missedcall via inbound Caller ID name leads to administrator takeover
F
Patch verifiedEPSS %0
7.6
CVE-2026-73662
Authenticated FreePBX Music RCE via mpg123 and Asterisk Call Files
F
Patch verifiedEPSS %1