FreePBX has 2 CVEs on record. The median CVSS is 8.3 (high), with 1 rated critical.

CVEs per month

Last 12 months, by publish date

1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10

Exploited share: 0% vs 1% corpus
Median CVSS: 8.3
Publish → KEV: —
Last 90 days: 0 prev 1

Weakness classes

Products

api 1
security-reporting 1

Follow FreePBX:RSS feed Save a search →Embed badge ↗

Total CVEs

Critical

CISA KEV

Exploited

Worst active — by depth score

CVE-2026-46376Critical· 9.3FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface63
CVE-2026-40520High· 7.2FreePBX api module Command Injection via GraphQL40

FreePBX vulnerabilities

CVEs affecting FreePBX, newest first. Open any entry for full detail, references, and exploit status.

2 CVEsRSS

CVE-2026-46376Critical· 9.3PoC

5mo ago

FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface

FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by …

▾ AbyssalFreePBX · security-reportingEPSS 0.43%via CVEORG

CVE-2026-40520High· 7.2

6mo ago

FreePBX api module Command Injection via GraphQL

FreePBX api module version 17.0.8 and prior contain a command injection vulnerability in the initiateGqlAPIProcess() function where GraphQL mutation input fields are passed directly to shell_exec() without sanitization or escaping. An au…

▾ TwilightFreePBX · apiEPSS 1.4%via CVEORG