CVE-2026-99999

[TCLvspa]

Hi team,

Our team recently reported the following vulnerability for our AWS EC2 instance running Debian-
- CVE-2026-99999 ("PwnEscape")

The accepted remediation path requires upgrading linux-image-cloud-amd64 from version 6.1.180-1 to 6.1.190-1.

OS Image: 3CX Phone System (Debian-based)

However, according to 3CX documentation (https://www.3cx.com/blog/voip-howto/os-security-updates-debian/), running manual Debian update commands such as apt-get update or apt-get install is not recommended on newer 3CX versions.

Could you please confirm if it is safe to upgrade this kernel package directly without affecting the 3CX application? If not, please advise on the recommended alternative solution for mitigating these vulnerabilities.

 

[Charles_3CX]

It is recommended to allow security updates to be installed automatically, which are enabled under the System >> Updates section

https://www.3cx.com/blog/change-log/pbx-security-updates/

You can run the following commands to check the version

uname -r
dpkg-query -W 'linux-image-*'

When the updates are run, you should see:
linux-image-amd64 6.1.190-1

Be aware that U10 is now released, and this will also be updated.
https://www.3cx.com/blog/releases/ai-agents-mcp-local-ai/

 

[TCLvspa]

Thank you for your response.
Confirming that automatic updates are scheduled. It looks like the hotfix was rolled out successfully-

uname -r returns 6.1.0-54-cloud-amd64