CVE-2026-23740Asterisk vulnerable to potential privilege escalation
Updated under an hour ago ()
Does this affect you?
It affects asterisk and 2 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux system) to that directory can cause root to execute arbitrary commands or overwrite arbitrary files by controlling the gdb init file and output paths. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
- CVSS
- 0.0 NONE (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:N
- Weakness (CWE)
- CWE-427
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- GitHub_M
- NVD analysis
- Analyzed
- Record last updated
- Feb 6, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
asterisk asterisk asterisk:asterisk (from the name) | before 23.2.2; before 22.8.2; before 21.12.1; before 20.18.2; before 20.7-cert9 | CNA record |
sangoma certified_asterisk sangoma:certified_asterisk | 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; 13.13.0; and 58 more ranges | NVD |
sangoma asterisk sangoma:asterisk | before 20.18.2; from 21.0.0 before 21.12.1; from 22.0.0 before 22.8.2; from 23.0.0 before 23.2.2 | NVD |
References
- https://github.com/asterisk/asterisk/security/advisories/GHSA-xpc6-x892-v83cx-refsource-confirm, vendor-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.