// tag

Sangoma

Security incidents tagged Sangoma. Newest first.

## 2 Sangoma incidents in the last 12 months

crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore

show 3 older incidents

Sep 2highSangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerabilitypatched
› Sangoma Switchvox patched
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Added to CISA KEV on 2026-09-02.
open incident →CVE-2026-9586

Feb 3highSangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerabilitypatched
› Sangoma FreePBX patched
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. Added to CISA KEV on 2026-02-03.
open incident →CVE-2025-64328

Aug 29criticalSangoma FreePBX: FreePBX Authentication Bypass Vulnerabilitypatched
› Sangoma FreePBX patched
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. Added to CISA KEV on 2025-08-29.
open incident →CVE-2025-57819