CVE-2026-73660 FreePBX CVE debrief

Who should care

Defenders responsible for FreePBX installations, especially those with elevated access to the administration interface, should assess exposure and prioritize patching. This includes administrators, security teams, and operators who manage FreePBX systems, as they need to be aware of the potential risks and take appropriate measures to protect their systems. Additionally, vulnerability management teams should review the vulnerability details and assess the

Why it matters

CVE-2026-73660 is a high-severity vulnerability in the FreePBX Text-To-Speech module that allows authenticated administrators to execute arbitrary operating-system commands. Defenders should prioritize patching vulnerable installations, restrict access to the administration interface, and monitor for suspicious activity.

• Potential for arbitrary operating-system command execution as the asterisk service user.
• Possible lateral movement or escalation of privileges.
• Need for verification of vulnerable versions and patch deployment.
• Potential impact on voice communication services.

Technical summary

The FreePBX Text-To-Speech module allows an authenticated administrator to save an HTML-encoded TTS destination name. During dialplan generation, the name is decoded, passed as an AGI argument, and used to build filenames inside agi-bin/propolys-tts.agi. This allows the TTS destination name to reach a raw shell-command execution path, enabling arbitrary operating-system command execution as the asterisk service user.

Defensive priority

Defenders should prioritize patching vulnerable FreePBX Text-To-Speech module installations, especially in environments where administrators have elevated access.

Recommended defensive actions

• Patch vulnerable FreePBX Text-To-Speech module installations to versions 16.0.6 or 17.0.5.4.
• Restrict access to the FreePBX administration interface.
• Monitor for suspicious activity on the asterisk service user account.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its high CVSS score of 7.5. However, the corpus does not provide information on in-the-wild exploitation or specific attack vectors.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.