Sangoma
Security incidents tagged Sangoma. Newest first.
2 Sangoma incidents in the last 12 months
- Incidents
- 3
- Live
- 0
- Patched
- 3
- Days without an incident
- 50
- Longest quiet run: 210 days (Feb 4–Sep 1)
Show 3 older incidents3 older incidents
September 2026 1
HighSangoma Switchvox: Sangoma Switchvox SQL Injection VulnerabilityPatched
Sangoma Switchvox Patched
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Added to CISA KEV on 2026-09-02.
Open incident →CVE-2026-9586
February 2026 1
HighSangoma FreePBX : Sangoma FreePBX OS Command Injection VulnerabilityPatched
Sangoma FreePBX Patched
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. Added to CISA KEV on 2026-02-03.
Open incident →CVE-2025-64328
August 2025 1
CriticalSangoma FreePBX: FreePBX Authentication Bypass VulnerabilityPatched
Sangoma FreePBX Patched
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. Added to CISA KEV on 2025-08-29.
Open incident →CVE-2025-57819
