Vendor
Sangoma
98 known vulnerabilities in products by Sangoma, 4 of them actively exploited (CISA KEV).
Key figures
98
Vulnerabilities
4
Actively exploited (KEV)
0
Used by ransomware
19
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-9586 | Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB In CISA KEV | 9.8 | |
| Critical | CVE-2025-57819 | FreePBX Affected by Authentication Bypass Leading to SQL Injection and RCE In CISA KEValso in 1 other product | 9.8 | |
| Critical | CVE-2025-64328 | FreePBX Administration GUI is Vulnerable to Authenticated Command Injection In CISA KEValso in 1 other product | 7.2 | |
| Critical | CVE-2019-19006 | Sangoma FreePBX Improper Authentication Vulnerability In CISA KEV | 9.8 | |
| High | CVE-2026-28287 | FreePBX: Authenticated Remote Code Execution via Recordings Module AJAX Endpoints | 8.8 | |
| High | CVE-2025-67736 | Authenticated SQL Injection in FreePBX tts (Text To Speech) module | 7.2 | |
| Critical | CVE-2021-45461 | Sangoma Restapps: Code Execution | 9.8 | |
| Critical | CVE-2025-66039 | FreePBX Framework: Improper Authentication | 9.8 | |
| High | CVE-2024-58294 | FreePBX 16 Authenticated Remote Code Execution via API Module | 8.8 | |
| High | CVE-2026-44237 | FreePBX: Authenticated Access can lead to Subsequent OAuth2 Authentication Bypass in API Module | 8.1 | |
| Critical | CVE-2019-12148 | Sangoma Session Border Controller (SBC) Firmware: Argument Injection | 9.8 | |
| Critical | CVE-2022-21723 | Out-of-bounds read in multipart parsing in PJSIP | 9.1 | |
| High | CVE-2023-49786 | Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation | 7.5 | |
| Critical | CVE-2019-12147 | Sangoma Session Border Controller (SBC) Firmware: Argument Injection | 9.8 | |
| Critical | CVE-2022-23608 | Use after free in PJSIP | 8.1 | |
| High | CVE-2023-49294 | Asterisk Path Traversal vulnerability | 4.9 | |
| Critical | CVE-2021-37706 | Potential integer underflow upon receiving STUN message in PJSIP | 7.3 | |
| Critical | CVE-2020-10666 | Sangoma Restapps: Remote Code Execution | 9.8 | |
| Medium | CVE-2018-12228 | Sangoma Asterisk: Infinite Loop | 6.5 | |
| High | CVE-2026-54674 | Authenticated Command Injection in FreePBX UCP Interface | 8.8 | |
| High | CVE-2026-75600 | FreePBX: Authenticated API generatedocs Host Command Injection | 8.8 | |
| Critical | CVE-2017-17430 | Sangoma Netborder / Vega Session Firmware: security vulnerability | 9.8 | |
| Critical | CVE-2025-32105 | Sangoma Img2020 Firmware: Buffer Overflow | 9.8 | |
| High | CVE-2019-19538 | Sangoma FreePBX: Privilege Escalation | 7.2 | |
| High | CVE-2017-9358 | Sangoma Asterisk: Infinite Loop | 7.5 |
News
Products
| Sangoma FreePBX | 50 | 2 |
| Asterisk | 28 | 0 |
| Certified Asterisk | 15 | 0 |
| Switchvox SMB Edition | 4 | 1 |
| Sangoma Switchvox | 3 | 1 |