VoIP Backbone Exposed: Critical FreePBX Flaw (CVE-2026-46376) Allows Unauthenticated Access to User Portals

FreePBX fixed a critical vulnerability (CVE-2026-46376, CVSS 9.1) in its User Control Panel where static, hard-coded template credentials used during generic UCP template setup could be abused by unauthenticated attackers to gain UCP access; affected FreePBX 16 versions prior to 16.0.45 and 17 versions prior to 17.0.7 should apply updates and follow recommended mitigations (randomized template passwords, restrict ACP/UCP access, firewall/segmentation, MFA/SAML).