Known exploited vulnerabilities
Sangoma vulnerabilities attackers have used
Every Sangoma vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 4 Sangoma vulnerabilities as exploited in the wild, 3 of them added in the last 12 months. The most recent is CVE-2026-9586, added Sep 2, 2026. FreePBX has the most entries (3).
- In KEV, all time
- 4
- Added, last 12 months
- 3
- Used in ransomware
- 0
- New CVEs this week
- 0
By product
FreePBX (3), Switchvox (1).
Every Sangoma entry in CISA KEV
CVE-2026-9586
Added · dueSangoma Switchvox SQL Injection Vulnerability
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database…
CVE-2025-64328
Added · dueSangoma FreePBX OS Command Injection Vulnerability
Sangoma FreePBX Endpoint Manager contains an OS command injection vulnerability that could allow for a post-authentication command injection by an authenticated known user via the testconnection -> check_ssh_connect() function. An attacker…
CVE-2019-19006
Added · dueSangoma FreePBX Improper Authentication Vulnerability
Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.
CVE-2025-57819
Added · dueSangoma FreePBX Authentication Bypass Vulnerability
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.