sangoma has 17 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 10 in the last 90 days against 1 in the 90 before. The busiest recent month was September 2026 with 6. The median CVSS is 8.8 (high), with 5 rated critical. 12% have been exploited in the wild — well above the 1% corpus average, so sangoma flaws are worth patching on sight. The dominant weakness classes are CWE-78 (4) and CWE-89 (4). Most affected products: freepbx (15), asterisk (1), switchvox (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 12% vs 1% corpus
- Median CVSS
- 8.8
- Publish → KEV
- —(2)
- Last 90 days
- 10 prev 1
Worst active — by depth score
CVE-2025-57819Critical· 9.8FreePBX is an open-source web-based graphical user interface98CVE-2026-9586Critical· 9.8An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into …83CVE-2025-66039Critical· 9.8FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems67CVE-2026-73665Critical· 9.8FreePBX is an open source IP PBX54CVE-2026-73663Critical· 9.8FreePBX is an open source IP PBX54
sangoma vulnerabilities
CVEs affecting sangoma, newest first. Open any entry for full detail, references, and exploit status.
17 CVEsRSS
CVE-2026-75600High· 8.8FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. Prior to version 17.0.9, authenticated users who are authorized to access the GraphQL api module interface of FreePBX are able to execute arbitrary shell commands. Authenticated access to the api module …
CVE-2026-54710High· 8.8FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the superfecta module due to unsafe inclusion of arbitrary PHP files, allowing authenticated attackers…
CVE-2026-54708High· 8.8FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that allows authenticated attackers to execute arbitrary code on the server. Authentication with a known…
CVE-2026-54675High· 8.8FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and conversion functionality that allows an authenticated attacker to perform arbitrary file writes, lea…
CVE-2026-54674High· 8.8FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute arbitrary commands on the PBX as the webserver user (typically asterisk) using specially crafted…
CVE-2026-45562High· 7.2FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a critical security flaw that allows authenticated attackers to execute arbitrary system commands with the privileges …
CVE-2026-73663Critical· 9.8FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from crafted SIP From headers into the missedcalllog INSERT in agi-bin/missedcallnotify.php without e…
CVE-2026-73662High· 7.2FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. From 17.0.1 until 17.0.7, the FreePBX Music on Hold module permits dangerous command-line options for /usr/bin/mpg123 and other allowed players in validateCustomConfiguration() in Music.class.php. An aut…
CVE-2026-73661Medium· 6.5FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore() in amp_conf/htdocs/admin/libraries/Buil…
CVE-2026-73665Critical· 9.8FreePBX is an open source IP PBX
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated…
CVE-2026-9586Critical· 9.8CISA KEVPoCAn unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into …
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into …
CVE-2025-67736High· 7.2The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk
The FreePBX module tts (Text to Speech) for FreePBX, an open-source web-based graphical user interface (GUI) that manages Asterisk. Versions prior to 16.0.5 and 17.0.5 are vulnerable to SQL injection by authenticated users with administr…
CVE-2025-67722High· 7.8FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk
FreePBX is an open-source web-based graphical user interface (GUI) that manages Asterisk. Prior to versions 16.0.45 and 17.0.24 of the FreePBX framework, an authenticated local privilege escalation exists in the deprecated FreePBX startu…
CVE-2025-66039Critical· 9.8PoCFreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems
FreePBX Endpoint Manager is a module for managing telephony endpoints in FreePBX systems. Versions are vulnerable to authentication bypass when the authentication type is set to "webserver." When providing an Authorization header with an…
CVE-2025-59429Medium· 5.4FreePBX is an open source GUI for managing Asterisk
FreePBX is an open source GUI for managing Asterisk. In versions prior to 16.0.68.39 for FreePBX 16 and versions prior to 17.0.18.38 for FreePBX 17, a reflected cross-site scripting vulnerability is present on the Asterisk HTTP Status pa…
CVE-2025-57819Critical· 9.8CISA KEV0dayPoCFreePBX is an open-source web-based graphical user interface
FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrar…
CVE-2022-37325High· 7.5In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.
In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a malformed Calling or Called Party IE can cause a crash.