ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-57193

Asterisk is an open source private branch exchange and telephony toolkit.

Published Oct 26, 2026 · catalog updated Oct 31, 2026 · Asterisk is an open

Last checked Nov 6, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-57193. EPSS is 1.96%. Act only if a listed version of Asterisk is an open is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Asterisk is an open).
  • No version range is stored. A customer cannot check an installed version against this record.
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium6.9
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
1.96%
Remediation
Not established
Affected products
See sources for product scope

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver may permit through a , allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The module must be loaded and configured to access an LDAP server, which is not the default. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3.

No affected version ranges are stored yet. Use the vendor advisory before you decide this record does not apply.

How to fix CVE-2026-57193

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-57193. EPSS is 1.96%. Act only if a listed version of Asterisk is an open is installed.

Which versions are affected?

Affected version ranges are not on this record. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-943. EPSS 1.96%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 26, 2026 · NIST NVD

    Detected

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver may permit through a , allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The module must be loaded and configured to acce

  2. Oct 31, 2026 · NIST NVD

    Updated

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver may permit through a , allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The module must be loaded and configured to acce

Sources

  • CVE.orgVulnerability recordCVE-2026-57193

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-57193

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver may permit through a , al

    nvd.nist.gov
  • Tenable CVE DatabaseVulnerability recordCVE-2026-57193

    Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, the LDAP realtime driver may permit through a , allowing an unauthenticated attacker to make arbitrary LDAP queries using carefully crafted SIP packets and disclose information. The module must be loaded and configured to acce

    tenable.com

References

Freshness

Last verified in this catalog Nov 6, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • Tenable CVE DatabaseNov 1, 2026
  • CVE.orgOct 31, 2026
  • NIST NVDOct 31, 2026