Vendor
Sangoma
As of , 4 Sangoma vulnerabilities are on CISA's list of exploited vulnerabilities; 3 were added in 2026. Patch first: CVE-2026-9586.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2026-9586SQL Injection | Sangoma Switchvox | Patch nowForensic triage required by CISA | 0.19 | ||
| 2 | CVE-2025-64328OS Command Injection | Sangoma FreePBX | Patch this weekMetasploit module; EPSS 0.85 | 0.85 | ||
| 3 | CVE-2025-57819Authentication Bypass | Sangoma FreePBX | Patch this weekMetasploit module; EPSS 0.85 | 0.85 | ||
| 4 | CVE-2019-19006Improper Authentication | Sangoma FreePBX | Patch this weekEPSS 0.56 | 0.56 |
Products
- FreePBX3 entries
- Switchvox1 entry
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2025 | 1 |
| 2026 | 3 |