Skip to content
Exploit Radar Choose my productsProducts My radar
English

Products › Brands

Brand

Sangoma: actively exploited vulnerabilities

4 vulnerabilities in Sangoma products (FreePBX, Switchvox) are in CISA’s catalog of exploited vulnerabilities, 1 of them added in the last 90 days. Last added: September 2, 2026.

Sangoma security advisories

The brand’s general security advisories page, not the advisory for a specific vulnerability (address checked September 28, 2026).

By category

Add just one Sangoma category to your radar, or open its page.

A high count also reflects how widely a product is deployed and how much attackers care about it: it is not a security rating.

Affected products

  • FreePBX 3 vulnerabilities · Collaboration and video
  • Switchvox 1 vulnerability · Collaboration and video

Name used by CISA: Sangoma. Product families: indicative classification by this site.

Patch first

In the order of the main list (Patch first): recent additions first, then the most severe. The number is the rank within this Sangoma list.

  1. Rank 1Sangoma Switchvox

    CVE-2026-9586

    Recently addedHunt for compromise (CISA)

    Sangoma Switchvox SQL Injection Vulnerability

    Added to the catalog less than 30 days ago: ranked by date added.

    Added
    Sep 2, 2026
    CISA deadline
    3 days
    CVSS severity
    9.8 (critical)

  2. Rank 2Sangoma FreePBX

    CVE-2019-19006

    CVE from 2019, added in 2026

    Sangoma FreePBX Improper Authentication Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Feb 3, 2026
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

  3. Rank 3Sangoma FreePBX

    CVE-2025-64328

    Sangoma FreePBX OS Command Injection Vulnerability

    Added in the last 12 months: ranked by severity.

    Added
    Feb 3, 2026
    CISA deadline
    21 days
    CVSS severity
    7.2 (high)

  4. Rank 4Sangoma FreePBX

    CVE-2025-57819

    Sangoma FreePBX Authentication Bypass Vulnerability

    Added more than a year ago: ranked by severity.

    Added
    Aug 29, 2025
    CISA deadline
    21 days
    CVSS severity
    9.8 (critical)

Follow and verify

Indicative classification, based on the vendor and product names given by CISA. How products are classified.