Sangoma vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Sangoma flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-9586 Sangoma Switchvox SQL InjectionExploited since Sep 2, 2026 · CVSS 9.3
• CVE-2025-64328 Sangoma FreePBX OS Command InjectionExploited since Feb 3, 2026 · CVSS 8.6
• CVE-2019-19006 Sangoma FreePBX Improper AuthenticationExploited since Feb 3, 2026 · CVSS 9.8
• CVE-2025-57819 Sangoma FreePBX Authentication BypassExploited since Aug 29, 2025 · CVSS 10

Latest high and critical flaws

• CVE-2026-9588 A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality.High 7 · Jul 17, 2026
• CVE-2026-9587 An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).High 7.1 · Jul 17, 2026
• CVE-2026-9586 Sangoma Switchvox SQL InjectionExploited · Critical 9.3 · Jul 17, 2026
• CVE-2026-9585 An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997).High 8.6 · Jul 17, 2026
• CVE-2025-64328 Sangoma FreePBX OS Command InjectionExploited · High 8.6 · Nov 6, 2025
• CVE-2025-57819 Sangoma FreePBX Authentication BypassExploited · Critical 10 · Aug 28, 2025
• CVE-2025-32105 A buffer overflow in the the Sangoma IMG2020 HTTP server through 2.3.9.6 allows an unauthenticated user to achieve remote code execution.Critical 9.8 · Jun 3, 2025
• CVE-2024-57520 Insecure Permissions vulnerability in asterisk v22 allows a remote attacker to execute arbitrary code via the action_createconfig function.Critical 9.8 · Feb 5, 2025
• CVE-2023-26566 Sangoma FreePBX 1805 through 2203 on Linux contains hardcoded credentials for the Asterisk REST Interface (ARI), which allows remote attackers to reconfigure AsHigh 8.6 · May 14, 2024
• CVE-2023-43336 Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modified parameter value,High 8.8 · Nov 2, 2023
• CVE-2023-26567 Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of global variables.High 8.1 · Apr 26, 2023
• CVE-2022-37325 In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malHigh 7.5 · Dec 5, 2022
• CVE-2021-45461 FreePBX, when restapps (aka Rest Phone Apps) 15.0.19.87, 15.0.19.88, 16.0.18.40, or 16.0.18.41 is installed, allows remote attackers to execute arbitrary code, Critical 9.8 · Dec 22, 2021
• CVE-2020-10666 The restapps (aka Rest Phone apps) module for Sangoma FreePBX and PBXact 13, 14, and 15 through 15.0.19.2 allows remote code execution via a URL variable to an Critical 9.8 · May 31, 2021
• CVE-2019-19538 In Sangoma FreePBX 13 through 15 and sysadmin (aka System Admin) 13.0.92 through 15.0.13.6 modules have a Remote Command Execution vulnerability that results inHigh 7.2 · Mar 16, 2020
• CVE-2019-19006 Sangoma FreePBX Improper AuthenticationExploited · Critical 9.8 · Nov 21, 2019
• CVE-2019-12148 The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to an authentication bypass via an argument injection vulnerability involvCritical 9.8 · Oct 22, 2019
• CVE-2019-12147 The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username field.Critical 9.8 · Oct 22, 2019
• CVE-2018-6393 FreePBX 10.13.66-32bit and 14.0.1.24 (SNG7-PBX-64bit-1712-2) allow post-authentication SQL injection via the order parameter.High 7.2 · Jan 29, 2018
• CVE-2017-17430 Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface.Critical 9.8 · Dec 7, 2017
• CVE-2017-9358 A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4, whiHigh 7.5 · Jun 2, 2017
• CVE-2012-4869 The callme_startcall function in recordings/misc/callme_page.php in FreePBX 2.9, 2.10, and earlier allows remote attackers to execute arbitrary commands via theHigh 7.5 · Sep 6, 2012
• CVE-2008-6598 Multiple race conditions in WANPIPE before 3.3.6 have unknown impact and attack vectors related to "bri restart logic."High 10 · Apr 3, 2009