How many Sangoma asterisk CVEs are in CISA KEV?

None of Sangoma asterisk's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Sangoma asterisk are affected?

110 distinct Sangoma asterisk versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Sangoma asterisk CVEs?

Sangoma asterisk's CVEs most often map to these CWE weakness types: CWE-427 (Uncontrolled Search Path Element), CWE-416 (Use After Free), CWE-476 (NULL Pointer Dereference), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).

How many critical Sangoma asterisk vulnerabilities are there?

Sangoma asterisk has 5 critical and 9 high-severity CVEs.

What is the average severity of Sangoma asterisk CVEs?

The average CVSS base score across Sangoma asterisk's scored CVEs is 7.1.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

Sangoma

28 CVEs

Sangoma asterisk Vulnerabilities

Name: Sangoma asterisk vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for asterisk by Sangoma.

28

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

9

Public exploits

PoC or exploit code

7.1

Avg CVSS

2009–2026

Last updated February 6, 2026

Overview

Sangoma asterisk has 28 published CVE records since 2009, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 9 have a known public exploit. The average CVSS base score across scored CVEs is 7.1.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Sangoma asterisk, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Sangoma asterisk's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical5

High9

Medium14

Low0

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Sangoma asterisk's CVEs are currently listed in CISA's KEV catalog.

Public exploits

9

9 of Sangoma asterisk's CVEs have a known public exploit available.

Affected versions and CVEs

Browse every Sangoma asterisk version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

23.0.0 <= v < 23.2.24 CVEs
< 20.18.23 CVEs
16.0.0 <= v < 16.24.13 CVEs
16.0.0 <= v < 16.29.13 CVEs
18.0.0 <= v < 18.10.13 CVEs
19.0.0 <= v < 19.2.13 CVEs
20.0.0 <= v <= 20.0.03 CVEs
21.0.0 <= v < 21.12.13 CVEs
22.0.0 <= v < 22.8.23 CVEs
< 18.26.22 CVEs
< 18.26.32 CVEs
19.0.0 <= v < 19.7.12 CVEs
20.0.0 <= v < 20.14.12 CVEs
20.0.0 <= v < 20.15.12 CVEs
21.0.0 <= v < 21.10.12 CVEs
21.0.0 <= v < 21.9.12 CVEs
22.0.0 <= v < 22.4.12 CVEs
22.0.0 <= v < 22.5.12 CVEs
< 18.24.31 CVE
< 18.26.41 CVE
< 20.15.21 CVE
<= 1.8.12.01 CVE
<= 1.8.15.01 CVE
<= 10.4.01 CVE
<= 10.7.01 CVE
<= 20.18.21 CVE
>= 22.0.01 CVE
1.6.1 <= v < 1.6.1.81 CVE
1.6.1 <= v <= 1.6.11 CVE
1.6.1.4 <= v <= 1.6.1.41 CVE
13.0 <= v < 13.37.11 CVE
13.0.0 <= v < 13.37.11 CVE
13.0.0 <= v <= 13.0.01 CVE
13.1.0 <= v <= 13.1.01 CVE
13.10.0 <= v <= 13.10.01 CVE
13.11.0 <= v <= 13.11.01 CVE
13.12.0 <= v <= 13.12.01 CVE
13.12.1 <= v <= 13.12.11 CVE
13.12.2 <= v <= 13.12.21 CVE
13.13.0 <= v <= 13.13.01 CVE
13.14.0 <= v <= 13.14.01 CVE
13.15.0 <= v <= 13.15.01 CVE
13.2.0 <= v <= 13.2.01 CVE
13.3.0 <= v <= 13.3.01 CVE
13.4.0 <= v <= 13.4.01 CVE
13.5.0 <= v <= 13.5.01 CVE
13.6.0 <= v <= 13.6.01 CVE
13.7.0 <= v <= 13.7.01 CVE
13.8.0 <= v <= 13.8.01 CVE
13.8.1 <= v <= 13.8.11 CVE
13.8.2 <= v <= 13.8.21 CVE
13.9.0 <= v <= 13.9.01 CVE
14.0.0 <= v <= 14.0.01 CVE
14.1.0 <= v <= 14.1.01 CVE
14.2.0 <= v <= 14.2.01 CVE
14.2.1 <= v <= 14.2.11 CVE
14.3.0 <= v <= 14.3.01 CVE
14.4.0 <= v <= 14.4.01 CVE
15.0 <= v < 15.4.11 CVE
16.0 <= v < 16.14.11 CVE
16.0.0 <= v < 16.14.11 CVE
17.0 <= v < 17.8.11 CVE
17.0.0 <= v < 17.8.11 CVE
17.0.0 <= v < 18.15.11 CVE
18.0 <= v < 18.0.11 CVE
18.0.0 <= v < 18.0.11 CVE
18.0.0 <= v < 18.15.11 CVE
18.14.0 <= v < 18.15.11 CVE
18.23.0 <= v <= 18.23.01 CVE
19.6.0 <= v < 19.7.11 CVE
20.0.0 <= v < 20.9.31 CVE
20.8.0 <= v <= 20.8.01 CVE
21.0.0 <= v < 21.10.21 CVE
21.0.0 <= v <= 21.12.11 CVE
21.0.0 <= v <= 21.4.31 CVE
21.3.0 <= v <= 21.3.01 CVE
22.0.0 <= v < 22.5.21 CVE
22.0.0 <= v <= 22.0.01 CVE
22.0.0 <= v <= 22.5.11 CVE
22.0.0 <= v <= 22.8.21 CVE

Fixed in

23.2.24 CVEs
16.24.13 CVEs
16.29.13 CVEs
18.10.13 CVEs
18.15.13 CVEs
19.2.13 CVEs
19.7.13 CVEs
20.18.23 CVEs
21.12.13 CVEs
22.8.23 CVEs
13.37.12 CVEs
16.14.12 CVEs
17.8.12 CVEs
18.0.12 CVEs

Find a version

28 CVEs

Sort

ast_coredumper running as root sources ast_debug_tools.conf from /etc/asterisk; potentially leading to privilege escalation
CVE-2026-23741
Patch
CWE-427
High · CVSS 8.8
EPSS 0.2% (7th pct)2026-02-06
Asterisk vulnerable to potential privilege escalation
CVE-2026-23740
Patch
CWE-427
High · CVSS 7.8
EPSS 0.1% (2th pct)2026-02-06
Asterisk xml.c uses unsafe XML_PARSE_NOENT leading to potential XXE Injection
CVE-2026-23739
Patch
CWE-611
Medium · CVSS 6.5
EPSS 0.2% (7th pct)2026-02-06
The Asterisk embedded web server 's /httpstatus page echos user supplied values(cookie and query string) without sanitization
CVE-2026-23738
Patch
CWE-79
Medium · CVSS 6.1
EPSS 0.2% (6th pct)2026-02-06
Asterisk Unsafe Shell Sourcing in safe_asterisk Leads to Local Privilege Escalation
CVE-2025-1131
Public exploit
Patch
CWE-427
High · CVSS 7.0
EPSS 0.2% (10th pct)2025-09-23
Asterisk can crash from a specifically malformed Authorization header in an incoming SIP request
CVE-2025-57767
Patch
CWE-253
High · CVSS 7.5
EPSS 0.4% (31th pct)2025-08-28
Asterisk remotely exploitable leak of RTP UDP ports and internal resources
CVE-2025-54995
Public exploit
Patch
CWE-400
Medium · CVSS 6.5
EPSS 0.4% (37th pct)2025-08-28
Asterisk is Vulnerable to Remote DoS and possible RCE Attacks During Memory Allocation
CVE-2025-49832
Public exploit
Patch
CWE-476
Medium · CVSS 6.5
EPSS 0.4% (36th pct)2025-08-01
cli_permissions.conf: deny option does not work for disallowing shell commands
CVE-2025-47780
Public exploit
Patch
CWE-78
Medium · CVSS 4.8
EPSS 0.2% (14th pct)2025-05-22
Using malformed From header can forge identity with ";" or NULL in name portion
CVE-2025-47779
Public exploit
Patch
CWE-140
High · CVSS 7.7
EPSS 0.5% (37th pct)2025-05-22
Critical vulnerability · 2025-02-05
CVE-2024-57520
Patch
CWE-732
Critical · CVSS 9.8
EPSS 1.0% (60th pct)2025-02-05
Medium vulnerability · 2024-12-02
CVE-2024-53566
Public exploit
Patch
CWE-22
Medium · CVSS 5.5
EPSS 0.3% (21th pct)2024-12-02
A malformed Contact or Record-Route URI in an incoming SIP request can cause Asterisk to crash when res_resolver_unbound is used
CVE-2024-42491
Patch
CWE-476
Medium · CVSS 5.7
EPSS 0.6% (43th pct)2024-09-05
Medium vulnerability · 2024-05-17
CVE-2024-35190
Patch
CWE-303
Medium · CVSS 5.8
EPSS 0.6% (44th pct)2024-05-17
Medium vulnerability · 2022-12-05
CVE-2022-42706
Patch
CWE-22
Medium · CVSS 4.9
EPSS 1.1% (62th pct)2022-12-05
Medium vulnerability · 2022-12-05
CVE-2022-42705
Patch
CWE-416
Medium · CVSS 6.5
EPSS 1.2% (66th pct)2022-12-05
High vulnerability · 2022-12-05
CVE-2022-37325
Patch
CWE-787
High · CVSS 7.5
EPSS 1.2% (64th pct)2022-12-05
Use after free in PJSIP
CVE-2022-23608
Public exploit
Patch
CWE-416
Critical · CVSS 9.8
EPSS 4.1% (90th pct)2022-02-22
Out-of-bounds read in multipart parsing in PJSIP
CVE-2022-21723
Public exploit
Patch
CWE-125
Critical · CVSS 9.1
EPSS 4.5% (90th pct)2022-01-27
Potential integer underflow upon receiving STUN message in PJSIP
CVE-2021-37706
Public exploit
Patch
CWE-191
Critical · CVSS 9.8
EPSS 4.6% (91th pct)2021-12-22
Medium vulnerability · 2020-11-06
CVE-2020-28327
Patch
Medium · CVSS 5.3
EPSS 2.0% (78th pct)2020-11-06
Medium vulnerability · 2020-11-06
CVE-2020-28242
Patch
Medium · CVSS 6.5
EPSS 1.5% (72th pct)2020-11-06
High vulnerability · 2019-10-29
CVE-2009-3723
Patch
High · CVSS 7.5
EPSS 1.2% (66th pct)2019-10-29
Medium vulnerability · 2018-06-12
CVE-2018-12228
Patch
Medium · CVSS 6.5
EPSS 6.8% (93th pct)2018-06-12
High vulnerability · 2017-06-02
CVE-2017-9358
Patch
High · CVSS 7.5
EPSS 2.8% (85th pct)2017-06-02
Critical vulnerability · 2012-08-31
CVE-2012-2186
Patch
Critical · CVSS 9.0
EPSS 3.6% (88th pct)2012-08-31
Medium vulnerability · 2012-06-02
CVE-2012-2948
Patch
Medium · CVSS 4.0
EPSS 2.1% (80th pct)2012-06-02
High vulnerability · 2009-09-08
CVE-2009-2346
Patch
High · CVSS 7.8
EPSS 2.6% (84th pct)2009-09-08

Common weakness types

The CWE weakness categories most often found in Sangoma asterisk CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Sangoma asterisk CVEs were published each year.

2009

1

2012

2

2017

1

2018

1

2019

1

2020

2

2021

1

2022

5

2024

3

2025

7

2026

4

Other Sangoma products

Browse vulnerabilities for other products by Sangoma.

freepbx42 CVEs certified asterisk15 CVEs Switchvox SMB Edition4 CVEs freepbx linux 72 CVEs restapps2 CVEs session border controller2 CVEs session border controller firmware2 CVEs switchvox2 CVEs

All Sangoma vulnerabilities

Frequently asked questions

Common questions about Sangoma asterisk vulnerabilities.

How many CVEs does Sangoma asterisk have?: Sangoma asterisk has 28 published CVE records since 2009.
How many Sangoma asterisk CVEs are in CISA KEV?: None of Sangoma asterisk's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Sangoma asterisk vulnerabilities?: Yes — 9 of Sangoma asterisk's CVEs have a known public exploit.
Which versions of Sangoma asterisk are affected?: 110 distinct Sangoma asterisk versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Sangoma asterisk CVEs?: Sangoma asterisk's CVEs most often map to these CWE weakness types: CWE-427 (Uncontrolled Search Path Element), CWE-416 (Use After Free), CWE-476 (NULL Pointer Dereference), CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')).
How many critical Sangoma asterisk vulnerabilities are there?: Sangoma asterisk has 5 critical and 9 high-severity CVEs.
What is the average severity of Sangoma asterisk CVEs?: The average CVSS base score across Sangoma asterisk's scored CVEs is 7.1.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Sangoma asterisk vulnerabilities

Monitor new Sangoma asterisk vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing

18.26.2

2 CVEs

18.26.32 CVEs

20.14.12 CVEs

20.15.12 CVEs

21.10.12 CVEs

21.9.12 CVEs

22.4.12 CVEs

22.5.12 CVEs

1.6.1.81 CVE

15.4.11 CVE

18.24.31 CVE

18.26.41 CVE

20.15.21 CVE

20.9.31 CVE

21.10.21 CVE

22.5.21 CVE