en
Sangoma is a multinational provider of communications hardware and software, notably the Switchvox Unified Communications suite. It supplies UC solutions, IP phones, SBCs, gateways, and related services for business customers.
Severity across 6 analyzed records
As of 09/11/2026, Sangoma recorded 4 security vulnerabilities in the last 90 days across 1 products, including 4 rated High or above and 1 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, Switchvox SMB Edition had the most security vulnerabilities in the Sangoma ecosystem, with 4 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-9588Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal | Exploitation statusNot known exploited | FixYes | Affected productSwitchvox SMB Edition | Published07/17/2026 | SeverityHigh |
CVE-2026-9587Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal | Exploitation statusNot known exploited | FixYes | Affected productSwitchvox SMB Edition | Published07/17/2026 | SeverityHigh |
CVE-2026-9586Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB | Exploitation statusKEV | FixYes | Affected productSwitchvox SMB Edition | Published07/17/2026 | SeverityCritical |
CVE-2026-9585Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal | Exploitation statusNot known exploited | FixYes | Affected productSwitchvox SMB Edition | Published07/17/2026 | SeverityHigh |
CVE-2026-44237FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published05/29/2026 | SeverityHigh |
CVE-2026-44238FreePBX: Authenticated SQL Injection via ORDER BY in CDR Reports | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published05/29/2026 | SeverityHigh |
CVE-2026-44239FreePBX: Authenticated Local File Inclusion in Dashboard Module | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published05/29/2026 | SeverityHigh |
CVE-2026-46376FreePBX: Unauthenticated Use of Hard-Coded Credentials Vulnerability in FreePBX UCP Interface | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published05/29/2026 | SeverityCritical |
CVE-2026-45362CVE-2026-45362 | Exploitation statusNot known exploited | FixYes | Affected productSwitchvox | Published05/12/2026 | SeverityLow |
CVE-2026-28287FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published03/05/2026 | SeverityHigh |
CVE-2026-28284FreePBX: Authenticated SQL Injection Vulnerabilities in FreePBX Logfiles Module | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published03/05/2026 | SeverityHigh |
CVE-2026-28210FreePBX: Authenticated SQL Injection in CDR (Call Data Record) Reports | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published03/05/2026 | SeverityHigh |
CVE-2026-28209FreePBX: Command Injection leading to Remote Code Execution in FreePBX ElevenLabs Text-to-Speech integration | Exploitation statusNot known exploited | FixYes | Affected productsecurity-reporting | Published03/05/2026 | SeverityHigh |
CVE-2025-55210FreePBX API has a Privilege Escalation Error in GraphQL Allowing Authenticated Users to Access Additional Scopes | Exploitation statusNot known exploited | FixYes | Affected productapi | Published02/12/2026 | SeverityLow |
CVE-2026-23741ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published02/06/2026 | SeverityInformational |
CVE-2026-23740Asterisk vulnerable to potential privilege escalation | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published02/06/2026 | SeverityHigh |
CVE-2026-23739Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published02/06/2026 | SeverityLow |
CVE-2026-23738The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published02/06/2026 | SeverityLow |
CVE-2025-67736Authenticated SQL Injection in FreePBX tts (Text To Speech) module | Exploitation statusNot known exploited | FixNot confirmed | Affected producttts | Published12/16/2025 | SeverityHigh |
CVE-2025-67722Authenticated amportal search for ‘freepbx_engine’ in non root writeable directories leads to potential privilege escalation | Exploitation statusNot known exploited | FixNot confirmed | Affected productframework | Published12/16/2025 | SeverityMedium |
CVE-2024-58294FreePBX 16 Authenticated Remote Code Execution via API Module | Exploitation statusPublic exploit | FixNot confirmed | Affected productFreePBX | Published12/11/2025 | SeverityHigh |
CVE-2025-66039FreePBX Endpoint Manager Allows Unauthenticated Logins to Administrator Control Panel via Forged Basic Auth Header | Exploitation statusNot known exploited | FixYes | Affected productframework | Published12/09/2025 | SeverityCritical |
CVE-2025-64328FreePBX Administration GUI is Vulnerable to Authenticated Command Injection | Exploitation statusKEV | FixYes | Affected productfilestore | Published11/07/2025 | SeverityHigh |
CVE-2025-59429FreePBX core module vulnerable to reflected cross-site scripting via Asterisk HTTP Status page | Exploitation statusPublic exploit | FixYes | Affected productcore | Published10/14/2025 | SeverityHigh |
CVE-2025-1131Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation | Exploitation statusPublic exploit | FixNot confirmed | Affected productasterisk | Published09/23/2025 | SeverityHigh |
CVE-2025-59056FreePBX vulnerable to unauthenticated Denial of Service | Exploitation statusNot known exploited | FixYes | Affected productframework | Published09/15/2025 | SeverityMedium |
CVE-2025-55211FreePBX Post-Authenticated Command Injection | Exploitation statusNot known exploited | FixYes | Affected productframework | Published09/15/2025 | SeverityMedium |
CVE-2025-57819FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE | Exploitation statusKEV | FixYes | Affected productendpoint | Published08/28/2025 | SeverityCritical |
CVE-2025-57767Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published08/28/2025 | SeverityHigh |
CVE-2025-54995Asterisk remotely exploitable leak of RTP UDP ports and internal resources | Exploitation statusPublic exploit | FixYes | Affected productasterisk | Published08/28/2025 | SeverityMedium |
CVE-2025-49832Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation | Exploitation statusPublic exploit | FixYes | Affected productasterisk | Published08/01/2025 | SeverityMedium |
CVE-2025-47780cli_permissions.conf: deny option does not work for disallowing shell commands | Exploitation statusPublic exploit | FixNot confirmed | Affected productasterisk | Published05/22/2025 | SeverityMedium |
CVE-2025-47779Using malformed From header can forge identity with ";" or NULL in name portion | Exploitation statusPublic exploit | FixNot confirmed | Affected productasterisk | Published05/22/2025 | SeverityHigh |
CVE-2024-57520CVE-2024-57520 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/05/2025 | SeverityCritical |
CVE-2024-53566CVE-2024-53566 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published12/02/2024 | SeverityMedium |
CVE-2024-53564CVE-2024-53564 | Exploitation statusNot known exploited | FixNot confirmed | Affected productFreePBX | Published12/02/2024 | SeverityLow |
CVE-2024-42491A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used | Exploitation statusNot known exploited | FixNot confirmed | Affected productasterisk | Published09/05/2024 | SeverityMedium |
CVE-2024-35190Asterisk' res_pjsip_endpoint_identifier_ip: wrongly matches ALL unauthorized SIP requests | Exploitation statusNot known exploited | FixYes | Affected productasterisk | Published05/17/2024 | SeverityMedium |
CVE-2023-49786Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation | Exploitation statusPublic exploit | FixNot confirmed | Affected productasterisk | Published12/14/2023 | SeverityHigh |
CVE-2023-37457Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update' | Exploitation statusNot confirmed | FixYes | Affected productasterisk | Published12/14/2023 | SeverityHigh |
CVE-2023-49294Asterisk Path Traversal vulnerability | Exploitation statusNot confirmed | FixNot confirmed | Affected productasterisk | Published12/14/2023 | SeverityMedium |
CVE-2023-43336CVE-2023-43336 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published11/02/2023 | SeverityUnknown |
CVE-2023-26567CVE-2023-26567 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published04/26/2023 | SeverityHigh |
CVE-2019-25090FreePBX arimanager Views cross site scripting | Exploitation statusNot confirmed | FixYes | Affected productarimanager | Published12/27/2022 | SeverityLow |
CVE-2021-4283FreeBPX voicemail Settings ssettings.php cross site scripting | Exploitation statusNot confirmed | FixYes | Affected productvoicemail | Published12/27/2022 | SeverityLow |
CVE-2021-4282FreePBX voicemail page.voicemail.php cross site scripting | Exploitation statusNot confirmed | FixYes | Affected productvoicemail | Published12/27/2022 | SeverityLow |
CVE-2020-36630FreePBX cdr Cdr.class.php ajaxHandler sql injection | Exploitation statusNot confirmed | FixYes | Affected productcdr | Published12/25/2022 | SeverityMedium |
CVE-2022-42706CVE-2022-42706 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/05/2022 | SeverityMedium |
CVE-2022-37325CVE-2022-37325 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/05/2022 | SeverityHigh |
CVE-2022-42705CVE-2022-42705 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published12/05/2022 | SeverityMedium |
CVE-2022-23608Use after free in PJSIP | Exploitation statusNot known exploited | FixYes | Affected productpjproject | Published02/22/2022 | SeverityHigh |
CVE-2021-45310CVE-2021-45310 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/14/2022 | SeverityUnknown |
CVE-2022-21723Out-of-bounds read in multipart parsing in PJSIP | Exploitation statusNot known exploited | FixYes | Affected productpjproject | Published01/27/2022 | SeverityCritical |
CVE-2021-37706Potential integer underflow upon receiving STUN message in PJSIP | Exploitation statusNot confirmed | FixNot confirmed | Affected productpjproject | Published12/22/2021 | SeverityHigh |
CVE-2020-28327CVE-2020-28327 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/06/2020 | SeverityUnknown |
CVE-2020-28242CVE-2020-28242 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/06/2020 | SeverityUnknown |
CVE-2019-19852CVE-2019-19852 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19615CVE-2019-19615 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19538CVE-2019-19538 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19851CVE-2019-19851 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published03/16/2020 | SeverityUnknown |
CVE-2019-19551CVE-2019-19551 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/06/2019 | SeverityUnknown |
CVE-2019-19552CVE-2019-19552 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/06/2019 | SeverityUnknown |
CVE-2019-19006CVE-2019-19006 | Exploitation statusKEV | FixNot confirmed | Affected productNot confirmed | Published11/21/2019 | SeverityCritical |
CVE-2009-3723CVE-2009-3723 | Exploitation statusNot confirmed | FixNot confirmed | Affected productasterisk | Published10/29/2019 | SeverityUnknown |
CVE-2019-16967CVE-2019-16967 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2019 | SeverityUnknown |
CVE-2019-16966CVE-2019-16966 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/21/2019 | SeverityUnknown |
CVE-2018-15891CVE-2018-15891 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/20/2019 | SeverityUnknown |
CVE-2018-12228CVE-2018-12228 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/12/2018 | SeverityUnknown |
CVE-2018-6393CVE-2018-6393 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/29/2018 | SeverityUnknown |
CVE-2017-9358CVE-2017-9358 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/02/2017 | SeverityUnknown |
CVE-2014-7235CVE-2014-7235 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published10/07/2014 | SeverityUnknown |
CVE-2014-1903CVE-2014-1903 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/18/2014 | SeverityUnknown |
CVE-2012-4869CVE-2012-4869 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/06/2012 | SeverityUnknown |
CVE-2012-4870CVE-2012-4870 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/06/2012 | SeverityUnknown |
CVE-2012-2186CVE-2012-2186 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/31/2012 | SeverityUnknown |
CVE-2012-2948CVE-2012-2948 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/02/2012 | SeverityUnknown |
CVE-2010-3490CVE-2010-3490 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published09/28/2010 | SeverityUnknown |
CVE-2009-2346CVE-2009-2346 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/08/2009 | SeverityUnknown |
CVE-2009-1802CVE-2009-1802 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/28/2009 | SeverityUnknown |
CVE-2009-1803CVE-2009-1803 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/28/2009 | SeverityUnknown |
CVE-2009-1801CVE-2009-1801 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/28/2009 | SeverityUnknown |
CVE-2008-6598CVE-2008-6598 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published04/03/2009 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
