CVE-2026-73665 FreePBX CVE debrief

Who should care

Defenders responsible for FreePBX deployments should assess exposure and prioritize upgrading to version 17.0.9 if vulnerable. This includes operators, platform administrators, vulnerability management teams, and security teams who need to verify exposure, review official advisories, and plan remediation efforts.

Why it matters

CVE-2026-73665 allows unauthenticated clients to execute arbitrary commands as the asterisk service user, requiring defenders to verify exposure and prioritize remediation.

• Potential arbitrary command execution as the asterisk service user
• Possible unauthorized access to custom namespaces
• Required verification of affected versions and remediation
• Need for monitoring suspicious activity on custom namespaces

Technical summary

The UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to custom namespaces that do not consistently invoke checkAuth in node/lib/auth.js and send crafted event values containing carriage-return or newline characters through the Asterisk Manager Interface action path patched by node/lib/asterisk-manager-patch.js, allowing arbitrary commands to execute as the asterisk service user.

Defensive priority

Defenders should prioritize verifying exposure of FreePBX UCP Node server on ports 8001 and 8003, and upgrading to version 17.0.9 if vulnerable.

Recommended defensive actions

• Verify exposure of FreePBX UCP Node server on ports 8001 and 8003
• Upgrade to version 17.0.9 if vulnerable
• Monitor for suspicious activity on custom namespaces
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD detail page provide information on the vulnerability, but additional verification is needed to confirm affected versions and remediation. Defenders should verify exposure of FreePBX UCP Node server on ports 8001 and 8003, review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance, and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.