CVE-2026-46376Critical· 9.3▾ AbyssalPoC available

FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score63/ 100 · Elevated

impact 51.2 · likelihood 0 · exploitation 12

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

A public proof-of-concept already exists for this vulnerability — see Exploit availability below.

…

Published

May 29, 2026

Updated

Sep 28, 2026

CVSS

9.3

Vendor

FreePBX

Product

security-reporting

CWE

CWE-798

Depth score

63 · Elevated

EPSS

—

Platforms

—

Source

CVEORG

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Exploit availability

Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.

checked 2026-09-28

GitHub PoCs

1 public repository

portbuster1337/CVE-2026-46376 ↗

CISA SSVC

decided 2026-05-29

Exploitation: none
Automatable: yes
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 123 days

May 29, 2026Published
Disclosed via CVEORG
Sep 28, 2026Record revised
Last analysed / modified upstream
Sep 28, 2026Public exploit observed
1 GitHub repo (last check)

FreePBX CWE-798 #cve.org #exploit-available

Affected

security-reporting >= 15.0.42, < 16.0.45
security-reporting >= 17.0.1, < 17.0.7

Full technical detail▾

Overview

FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Administrator who enabled UCP. Authenticated access to ACP is required for the initial setup of UCP generic templates, but after that, without further steps by the admin, unauthenticated users may be able to gain access. This vulnerability is fixed in 16.0.45 and 17.0.7.

Affected

security-reporting >= 15.0.42, < 16.0.45
security-reporting >= 17.0.1, < 17.0.7

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m55x-h47x-v3gx — https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m55x-h47x-v3gx

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org#exploit-available

FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

▾ Abyssal zone — Critical with a public exploit or in-the-wild use

Depth score63/ 100 · Elevated

impact 51.2 · likelihood 0 · exploitation 12

Overview