FreePBX security advisory (AV26–474)

Serial number: AV26–474
Date: May 15, 2026

On May 15, 2026, FreePBX published a security advisory to address a critical vulnerability in the following products:

• FreePBX Security-Reporting userman (FreePBX 16) – versions 16.0.45 and prior
• FreePBX Security-Reporting userman (FreePBX 17) – versions 17.0.7 and prior

The Cyber Centre encourages users and administrators to review the web links provided, apply the necessary updates and perform the suggested mitigations.

• Unauthenticated Use of Hard-Coded Credentials Vulnerability in Free PBX UCP Interface
• FreePBX Security Advisories