FreePBX CVE-2026-73664

Exploitation requires an active authenticated session with FreePBX administrator privileges (CVSS PR:H confirmed). The target must be running FreePBX version 17.0.5.34 through 17.0.10.x. The publicKeySave AJAX endpoint within the Backup module must be reachable, which is the default state in affected installations - no non-default configuration is required to expose it. SSH access to the host must also be network-reachable for post-exploitation shell use, though the key injection itself only requires HTTP/HTTPS access to the admin panel. Exploitation is limited by the requirement for prior administrator-level authentication; unauthenticated or low-privileged users cannot trigger this endpoint. No user interaction beyond the attacker's own admin session is needed.

The CVSS 4.0 score of 8.6 (PR:H) accurately reflects that this vulnerability requires existing authenticated administrator access to the FreePBX web interface, which is the primary limiting factor on its real-world impact. However, this should not be dismissed - administrator credentials are frequently shared, reused, or phished in SMB and managed-service-provider environments, meaning even a mid-sized municipal IT team in sopot operating a self-hosted FreePBX deployment should treat this as urgent given the severity of post-exploitation capability. The key risk amplifier is the privilege escalation dimension: an attacker who holds FreePBX admin credentials gains persistent, unrestricted OS shell access as the asterisk system user, which can be leveraged to exfiltrate call records, intercept VoIP traffic, pivot within the local network, or achieve persistence independent of the FreePBX application layer. EPSS data was not included in available intelligence, so exploitation probability cannot be quantified. KEV status is not confirmed; no POC has been identified. The absence of special deployment conditions beyond admin authentication (the endpoint is present by default in affected versions) means any unpatched, internet-exposed FreePBX admin panel represents a meaningful risk.

An attacker who has obtained FreePBX administrator credentials - through phishing, credential stuffing, or insider access - sends a crafted POST request to the publicKeySave AJAX endpoint with their own SSH public key as the payload. The endpoint appends the key to /home/asterisk/.ssh/authorized_keys without a forced-command restriction, after which the attacker opens an SSH session directly to the host as the asterisk user, establishing persistent OS-level access independent of the FreePBX web session. No public proof-of-concept has been identified, but the attack is technically straightforward for anyone with admin credentials.