pwn.watch: Sangoma incident updates

[high] Sangoma Switchvox: Sangoma Switchvox SQL Injection Vulnerability

Wed, 02 Sep 2026 00:00:00 GMT

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Added to CISA KEV on 2026-09-02.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-09-02: CISA added CVE-2026-9586 to the KEV catalog (due 2026-09-05).

CVEs: CVE-2026-9586

[high] Sangoma FreePBX : Sangoma FreePBX OS Command Injection Vulnerability

Tue, 03 Feb 2026 00:00:00 GMT

Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker can leverage this vulnerability to potentially obtain remote access to the system as an asterisk user. Added to CISA KEV on 2026-02-03.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-03: CISA added CVE-2025-64328 to the KEV catalog (due 2026-02-24).

CVEs: CVE-2025-64328

[critical] Sangoma FreePBX: FreePBX Authentication Bypass Vulnerability

Fri, 29 Aug 2025 00:00:00 GMT

Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. Added to CISA KEV on 2025-08-29.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-08-29: CISA added CVE-2025-57819 to the KEV catalog (due 2025-09-19).

CVEs: CVE-2025-57819