https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-34335.htmlhttps://patchthecve.com/cve/CVE-2025-34335.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.8: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an authenticated command injection vulnerability in the license activation workflow handled by AudioCodes_files/ActivateLicense.php. When a license file is uploaded, the application derives a new filenhttps://patchthecve.com/cve/CVE-2025-34334.htmlhttps://patchthecve.com/cve/CVE-2025-34334.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.8: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 are vulnerable to an authenticated command injection in the fax test functionality implemented by AudioCodes_files/TestFax.php. When a fax "send" test is requested, the application builds a faxsender command https://patchthecve.com/cve/CVE-2025-34333.htmlhttps://patchthecve.com/cve/CVE-2025-34333.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.8: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 configure the web document root at C:\\F2MAdmin\\F2E with overly permissive file system permissions. Authenticated local users have modify rights on this directory, while the associated web server process runhttps://patchthecve.com/cve/CVE-2025-34332.htmlhttps://patchthecve.com/cve/CVE-2025-34332.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.8: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component that controls back-end Windows services using helper batch scripts located under C:\\F2MAdmin\\F2E\\AudioCodes_files\\utils\\Services. When certain service actions are rhttps://patchthecve.com/cve/CVE-2025-34331.htmlhttps://patchthecve.com/cve/CVE-2025-34331.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.5: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 contain an unauthenticated file read vulnerability via the download.php script. The endpoint exposes a file download mechanism that lacks access control, allowing remote, unauthenticated users to request filehttps://patchthecve.com/cve/CVE-2025-34330.htmlhttps://patchthecve.com/cve/CVE-2025-34330.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 5.3: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated prompt upload endpoint at AudioCodes_files/utils/IVR/diagram/ajaxPromptUploadFile.php. The script accepts an uploaded file andhttps://patchthecve.com/cve/CVE-2025-34329.htmlhttps://patchthecve.com/cve/CVE-2025-34329.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.8: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 expose an unauthenticated backup upload endpoint at AudioCodes_files/ajaxBackupUploadFile.php in the F2MAdmin web interface. The script derives a backup folder path from application configuration, creates thehttps://patchthecve.com/cve/CVE-2025-34328.htmlhttps://patchthecve.com/cve/CVE-2025-34328.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.8: AudioCodes Fax Server and Auto-Attendant IVR appliances versions up to and including 2.6.23 include a web administration component (F2MAdmin) that exposes an unauthenticated script-management endpoint at AudioCodes_files/utils/IVR/diagram/ajaxScript.php. The saveScript action writes attacker-supplie