CVE-2026-73662 FreePBX CVE debrief

Who should care

FreePBX administrators and security teams responsible for managing and securing the FreePBX system should assess exposure to CVE-2026-73662 and prioritize updating to version 17.0.7 or later. They should also monitor for suspicious activity related to the asterisk service user and review compensating controls for exposed systems. Additionally, they should verify current version and exposure, and track exceptions and retest remediated assets. Security teams

Why it matters

CVE-2026-73662 is a high-severity vulnerability in the FreePBX Music on Hold module that allows authenticated administrators to execute arbitrary commands. FreePBX administrators and security teams should assess exposure, prioritize updating to version 17.0.7 or later, and monitor for suspicious activity.

• Potential for arbitrary command execution as the asterisk service user
• Risk of compromise of the FreePBX system
• Need for verification of current version and exposure
• Priority for updating to version 17.0.7 or later

Technical summary

The FreePBX Music on Hold module versions 17.0.1 to 17.0.6 permit dangerous command-line options for /usr/bin/mpg123 and other allowed players, allowing authenticated administrators to execute arbitrary commands as the asterisk service user. This occurs because applicationUsesDisallowedPlayerOption() does not reject those arguments. The issue is fixed in version 17.0.7, which properly handles command-line options and prevents arbitrary command execution. FreePBX administrators should update to the fixed version to mitigate this high-severity vulnerability.

Defensive priority

High priority for FreePBX administrators and security teams

Recommended defensive actions

• Update FreePBX Music on Hold module to version 17.0.7 or later
• Restrict access to the Music on Hold module for authenticated administrators
• Monitor for suspicious activity related to the asterisk service user
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in FreePBX Music on Hold module versions 17.0.1 to 17.0.6, which allows authenticated administrators to execute arbitrary commands as the asterisk service user.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.