FreePBX security advisory (AV26–596)

Serial number: AV26–596
Date: June 12, 2026

On June 12, 2026, FreePBX published security advisories to address vulnerabilities in the following products:

• FreePBX Security-Reporting ucp (FreePBX 16) – versions prior to 0.39
• FreePBX Security-Reporting ucp (FreePBX 17) – versions prior to 0.7
• FreePBX Security-Reporting superfecta (FreePBX 16) – versions prior to 16.0.40
• FreePBX Security-Reporting superfecta (FreePBX 17) – versions prior to 17.0.7

The Cyber Centre encourages users and administrators to review the web links provided, apply the necessary updates and perform the suggested mitigations.

• Authenticated Command Injection in FreePBX UCP Interface
• Authenticated Superfecta Arbitrary PHP Code Execution (RCE via Unsafe File Inclusion)
• FreePBX Security Advisories