Unauthenticated remote code execution in FreePBX UCP Node server (CVE-2026-73665)

FreePBX versions prior to 17.0.9 contain an authentication bypass in the UCP Node server caused by Socket.IO v4 applying middleware only to the default namespace, leaving custom namespaces unauthenticated. An unauthenticated remote attacker can connect to these namespaces and inject carriage-return or newline characters into Asterisk Manager Interface action calls, achieving arbitrary command execution as the asterisk service user with no user interaction required. Affected versions: - < 17.0.9 We recommend updating to: 17.0.9. CVSS 9.3 · our assessment: act_now Reference: https://github.com/FreePBX/security-reporting/security/advisories/GHSA-37j8-fhxx-9vhp Details: https://vuln.today/cve/CVE-2026-73665