CVE-2026-23739

CVE-2026-23739 is a low-severity vulnerability in Sangoma Asterisk with a CVSS 3.x base score of 2.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-611.

Key facts

Description

Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclude processing. Specifically, it invokes xmlReadFile() with the XML_PARSE_NOENT flag and later processes XIncludes via xmlXIncludeProcess().If any untrusted or user-supplied XML file is passed to this function, it can allow an attacker to trigger XML External Entity (XXE) or XInclude-based local file disclosure, potentially exposing sensitive files from the host system. This can also be triggered in other cases in which the user is able to supply input in xml format that triggers the asterisk process to parse it. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.

Frequently asked questions

What is CVE-2026-23739?
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, the ast_xml_open() function in xml.c parses XML documents using libxml with unsafe parsing options that enable entity expansion and XInclude processing. Specifically, it invokes xmlReadFile() with the XML_PARSE_NOENT flag and later processes XIncludes via xmlXIncludeProcess().If any untrusted or user-supplied XML file is passed to this function, it can allow an attacker to trigger XML External Entity (XXE) or XInclude-based local file disclosure, potentially exposing sensitive files from the host system. This can also be triggered in other cases in which the user is able to supply input in xml format that triggers the asterisk process to parse it. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
How severe is CVE-2026-23739?
CVE-2026-23739 has a CVSS 3.x base score of 2.0, rated low severity. It is exploitable over network with high attack complexity, requires high privileges and user interaction. Impact on confidentiality is none, integrity low, and availability none.
Is CVE-2026-23739 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (7th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-23739?
CVE-2026-23739 primarily affects Sangoma Asterisk. In total, 12 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2026-23739?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-23739 have an EU (EUVD) identifier?
Yes. CVE-2026-23739 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-5646.
When was CVE-2026-23739 published?
CVE-2026-23739 was published on 2026-02-06 and last updated on 2026-06-17.

References

Affected products (12)

More vulnerabilities in Sangoma Asterisk

All CVEs affecting Sangoma Asterisk →

Other CWE-611 (Improper Restriction of XML External Entity Reference (XXE)) vulnerabilities

Browse all CWE-611 (Improper Restriction of XML External Entity Reference (XXE)) vulnerabilities →