sangoma
Safeguard articles tagged "sangoma" — guides, analysis, and best practices for software supply chain and application security.
6 articles
CVE-2025-57819: Sangoma FreePBX Authentication Bypass Vulnerability
CVE-2025-57819 affects Sangoma FreePBX and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2025-08-29.
CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability
CVE-2019-19006 affects Sangoma FreePBX and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2026-02-03.
CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability
CVE-2025-64328 affects Sangoma FreePBX and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2026-02-03.
CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability
CVE-2026-9586 affects Sangoma Switchvox and is listed in CISA's Known Exploited Vulnerabilities catalog, meaning exploitation has been observed in the wild. Added 2026-09-02.
Two More FreePBX CVEs, Six Years Apart, Confirmed Exploited on the Same Day
A 2025 command injection bug in FreePBX's Endpoint Manager and a 2019 authentication bypass landed in KEV together, additional findings beyond FreePBX coverage published elsewhere in this series.
Sangoma Switchvox's Phone-Provisioning Feature Was an Unauthenticated SQL Injection
CVE-2026-9586 abuses Switchvox's Polycom phone-provisioning endpoint, concatenating device-submitted XML directly into a SQL query with no authentication required.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.