Asterisk vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-57191 Asterisk is an open source private branch exchange and telephony toolkit.High 8.2 · Oct 27, 2026
• CVE-2026-57190 Asterisk is an open source private branch exchange and telephony toolkit.High 7 · Oct 27, 2026
• CVE-2026-57186 Asterisk is an open source private branch exchange and telephony toolkit.High 7.5 · Oct 27, 2026
• CVE-2026-57200 Asterisk is an open source private branch exchange and telephony toolkit.High 7.5 · Oct 27, 2026
• CVE-2026-57195 Asterisk is an open source private branch exchange and telephony toolkit.High 7.5 · Oct 27, 2026
• CVE-2026-57202 Asterisk is an open source private branch exchange and telephony toolkit.High 8.1 · Oct 27, 2026
• CVE-2026-57188 Asterisk is an open source private branch exchange and telephony toolkit.High 7.1 · Oct 27, 2026
• CVE-2026-57201 Asterisk is an open source private branch exchange and telephony toolkit.High 7.5 · Oct 27, 2026
• CVE-2026-57197 Asterisk is an open source private branch exchange and telephony toolkit.High 7.7 · Oct 27, 2026
• CVE-2026-57187 Asterisk is an open source private branch exchange and telephony toolkit.High 7.1 · Oct 26, 2026
• CVE-2025-1131 A local privilege escalation vulnerability exists in the safe_asterisk script included with the Asterisk toolkit package.High 7 · Sep 23, 2025
• CVE-2025-57767 Asterisk is an open source private branch exchange and telephony toolkit.High 7.5 · Aug 28, 2025
• CVE-2025-47779 Asterisk is an open-source private branch exchange (PBX).High 7.7 · May 22, 2025
• CVE-2024-42365 Asterisk is an open source private branch exchange (PBX) and telephony toolkit.High 7.4 · Aug 8, 2024
• CVE-2023-49786 Asterisk is an open source private branch exchange and telephony toolkit.High 7.5 · Dec 14, 2023
• CVE-2023-37457 Asterisk is an open source private branch exchange and telephony toolkit.High 7.5 · Dec 14, 2023
• CVE-2009-3723 asterisk allows calls on prohibited networksHigh 7.5 · Oct 29, 2019
• CVE-2013-2685 Stack-based buffer overflow in res/res_format_attr_h264.c in Asterisk Open Source 11.x before 11.2.2 allows remote attackers to execute arbitrary code via a lonHigh 7.5 · Apr 1, 2013
• CVE-2012-2186 Incomplete blacklist vulnerability in main/manager.c in Asterisk Open Source 1.8.x before 1.8.15.1 and 10.x before 10.7.1, Certified Asterisk 1.8.11 before 1.8.High 9 · Aug 31, 2012
• CVE-2009-2346 The IAX2 protocol implementation in Asterisk Open Source 1.2.x before 1.2.35, 1.4.x before 1.4.26.2, 1.6.0.x before 1.6.0.15, and 1.6.1.x before 1.6.1.6; BusineHigh 7.8 · Sep 8, 2009
• CVE-2008-5744 Array index error in the dahdi/tor2.c driver in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwrite an integer value in kHigh 7.2 · Dec 26, 2008
• CVE-2008-5396 Array index error in the (1) torisa.c and (2) dahdi/tor2.c drivers in Zaptel (aka DAHDI) 1.4.11 and earlier allows local users in the dialout group to overwriteHigh 7.2 · Dec 8, 2008
• CVE-2008-3264 The FWDOWNL firmware-download implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x beforeHigh 7.8 · Jul 24, 2008
• CVE-2008-3263 The IAX2 protocol implementation in Asterisk Open Source 1.0.x, 1.2.x before 1.2.30, and 1.4.x before 1.4.21.2; Business Edition A.x.x, B.x.x before B.2.5.4, anHigh 7.8 · Jul 22, 2008
• CVE-2008-1923 The IAX2 channel driver (chan_iax2) in Asterisk 1.2 before revision 72630 and 1.4 before revision 65679, when configured to allow unauthenticated calls, sends "High 7.1 · Apr 23, 2008