What’s Vulnerable › Vulnerabilities
CVE-2026-23740: Asterisk vulnerable to potential privilege escalation
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-02-06 · updated 2026-06-17
- Weakness: CWE-427
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2, when ast_coredumper writes its gdb init and output files to a directory that is world-writable (for example /tmp), an attacker with write permission(which is all users on a linux system) to that directory can cause root to execute arbitrary commands or overwrite arbitrary files by controlling the gdb init file and output paths. This issue has been patched in versions 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, and 23.2.2.
Affected products
- asterisk: before 20.18.2; from 21.0.0 before 21.12.1; from 22.0.0 before 22.8.2; from 23.0.0 before 23.2.2 — fixed in 20.18.2, 21.12.1, 22.8.2, 23.2.2
- Sangoma Certified Asterisk: 13.13.0, 13.13.0-cert1, 13.13.0-cert1-rc1, 13.13.0-cert1-rc2, 13.13.0-cert1-rc3, 13.13.0-cert1-rc4 (+60)
How to fix
Upgrade to a fixed version: asterisk 20.18.2, 21.12.1, 22.8.2, 23.2.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-23740 or the next vulnerability affects your stack