CVE-2026-54710

Published 28 September 2026 · tracked since 29 September 2026

Description

FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers to execute arbitrary PHP code on the server with the privilege

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-110199 MEDIUM 4.8
• CVE-2026-128128 HIGH 7.5
• CVE-2026-127217 MEDIUM 6.4
• CVE-2026-127216 MEDIUM 6.5
• CVE-2026-68905 HIGH 8.2
• CVE-2026-128089 HIGH 7.5
• CVE-2026-127215 HIGH 8.1
• CVE-2026-127214 HIGH 8.5
• CVE-2026-128088 LOW 2.2
• CVE-2026-128087 LOW 3.7

→ Open the live CVE board · all tools