High severity · published Oct 27, 2026
CVE-2026-57200
Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE
New
7.5
CVSS
–
EPSS
No
On KEV
Description
Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3, an authenticated attacker with read-only permissions for the `Asterisk REST Interface (ARI)` may, under certain conditions, execute write operations through `REST-over-WebSocket`. The authorization bypass permits `arbitrary module path` loading and conditional remote code execution. The Asterisk HTTP web server must be enabled and reachable, and the attacker must already have valid `read-only ARI credentials`. HTTP is disabled by default and binds only to 127.0.0.1 by default even when enabled. This issue is fixed in Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 22.8-cert3.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AS
asterisk · asterisk
< 20.20.1; >= 21.0.0-pre1, < 21.12.3; >= 22.0.0-pre1, < 22.10.1; >= 23.0.0-pre1, < 23.4.1 · source: vendor
CE
certified-asterisk · certified-asterisk
>= 22.8-cert1-pre1, < 22.8-cert3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-57200
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-57200
github.com
https://github.com/asterisk/asterisk/commit/051d29a0d35559e9165bab346de9422e25415533
github.com
https://github.com/asterisk/asterisk/commit/205c301a0a0b0d013d4ebdf12856ebbc30405350
github.com
https://github.com/asterisk/asterisk/commit/762b4c9c39b28fa5564112b0f484012298469a6c
github.com
https://github.com/asterisk/asterisk/commit/87641e9b2cd62c998c5283400ba77b61b5b07dd4
github.com
https://github.com/asterisk/asterisk/commit/9d198a7d16ccba51507dfea6c1ecc511e89d698a
github.com
https://github.com/asterisk/asterisk/commit/c10cdbce072a708060cd38a89d6850808fe6bf46
More from asterisk
8.8
CVE-2024-42365
Asterisk is an open source private branch exchange (PBX) and telephony toolkit
8.2
CVE-2026-57191
Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsing
8.1
CVE-2026-57202
Asterisk: ARI setChannelVar bypasses live_dangerously and permits FILE() writes
7.7
CVE-2026-57197
Asterisk: Heap Buffer Overflow in OGG/Speex File Playback (format_ogg_speex)
7.5
CVE-2026-57186
Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-number parser