CVE-2026-23739
📋 TL;DR
This CVE describes an XML External Entity (XXE) vulnerability in Asterisk's XML parsing function. It allows attackers to read sensitive files from the host system when untrusted XML is processed. Affected systems are Asterisk installations prior to patched versions that parse user-supplied XML.
💻 Affected Systems
- Asterisk
📦 What is this software?
Asterisk by Sangoma
Asterisk by Sangoma
Asterisk by Sangoma
Asterisk by Sangoma
⚠️ Risk & Real-World Impact
Worst Case
Complete disclosure of sensitive host files including configuration files, credentials, and system information leading to full system compromise.
Likely Case
Limited file disclosure from the Asterisk process context, potentially exposing configuration files and telephony-related data.
If Mitigated
No impact if XML parsing is restricted to trusted sources or the vulnerability is patched.
🎯 Exploit Status
Exploitation requires the ability to supply XML input to Asterisk's XML parsing functions, which may be available through various interfaces.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2 depending on your branch
Vendor Advisory: https://github.com/asterisk/asterisk/security/advisories/GHSA-85x7-54wr-vh42
Restart Required: Yes
Instructions:
1. Identify your Asterisk version. 2. Upgrade to the appropriate patched version for your branch. 3. Restart Asterisk service. 4. Verify the fix is applied.
🔧 Temporary Workarounds
Disable XML processing
allIf XML features are not required, disable XML parsing functionality in Asterisk configuration.
# Review and modify Asterisk configuration to disable XML-related modules and features
Restrict XML input sources
allEnsure only trusted, validated XML sources are processed by Asterisk.
# Configure Asterisk to only accept XML from trusted sources and implement input validation
🧯 If You Can't Patch
- Implement strict input validation and sanitization for all XML input to Asterisk
- Use network segmentation to isolate Asterisk systems and restrict access to sensitive files
🔍 How to Verify
Check if Vulnerable:
Check Asterisk version with 'asterisk -V' and compare against affected versions list.Check Version:
asterisk -VVerify Fix Applied:
Verify version is 20.7-cert9, 20.18.2, 21.12.1, 22.8.2, or 23.2.2 or newer using 'asterisk -V'.📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- File access attempts from Asterisk process
- Large XML document processing
Network Indicators:
- XML payloads containing external entity references or XInclude directives sent to Asterisk
SIEM Query:
source="asterisk.log" AND ("xml" OR "XXE" OR "XInclude")