Sangoma known exploited vulnerabilities
CISA's Known Exploited Vulnerabilities catalog lists 4 Sangoma vulnerabilities: 3 added in the last 365 days, 3 rated critical (CVSS 9 or higher), and 0 with known ransomware use. The most recent was added Sep 2, 2026.
RSS feed for Sangoma exploited vulnerabilities · Search them on KEVWire · Ask your AI assistant
| Added to KEV | CVE | Vulnerability | CVSS | EPSS | Federal due date | Ransomware use |
|---|---|---|---|---|---|---|
| 2026-09-02 | CVE-2026-9586 | Sangoma Switchvox SQL Injection Vulnerability | 9.3 (v4.0) | 19.0% | 2026-09-05 | Unknown |
| 2026-02-03 | CVE-2019-19006 | Sangoma FreePBX Improper Authentication Vulnerability | 9.8 (v3.1) | 55.9% | 2026-02-24 | Unknown |
| 2026-02-03 | CVE-2025-64328 | Sangoma FreePBX OS Command Injection Vulnerability | 8.6 (v4.0) | 84.6% | 2026-02-24 | Unknown |
| 2025-08-29 | CVE-2025-57819 | Sangoma FreePBX Authentication Bypass Vulnerability | 10 (v4.0) | 95.0% | 2025-09-19 | Unknown |