Do Son Apply the latest update to fix critical FreePBX vulnerabilities, including a 9.3 CVSS authentication bypass and privilege escalation in User Manager.
VOIP
FreeSWITCH vulnerability CVE-2026-116779 (CVSS 9.8) is exploited in the wild, letting a SIP MESSAGE run server commands. Upgrade to 1.11.3 now.
Two critical FreePBX RCE vulnerabilities in Superfecta and UCP modules expose servers to authenticated arbitrary code execution and command injection.
A critical authentication bypass (CVSS 9.3) in FreePBX allows complete PBX takeover when the 'webserver' auth mode is enabled. Attackers can gain an admin session with a crafted HTTP header. Update immediately.
Rtpengine's critical flaws (CVE-2025-53399, CVSS 9.3) allow attackers to intercept or inject audio into active VoIP calls, even without a MitM position, by exploiting SRTP validation.
Two flaws in Mitel SIP phones—CVE-2025-47188 and CVE-2025-47187—enable remote command execution and file uploads, putting enterprise networks at risk.
The transfer technology of voice over the internet protocol has been something that many people have used...