FreePBX Vulnerability Allow Attackers to Gain Access to User Portals

A critical vulnerability (CVE-2026-46376) in FreePBX's User Control Panel stems from hard-coded sample credentials in the userman module, allowing unauthenticated remote access to UCP in FreePBX versions before 16.0.45 and 17.0.7; it carries a CVSS v4 base score of 9.1 and administrators are urged to apply vendor patches and harden deployments immediately.