CVE Watch—

CVE-2025-57819

Sangoma FreePBX Authentication Bypass Vulnerability

CVSS

—

No CVSS

EPSS

93.3%

p100

KEV

YES

Aug 29, 2025

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

93.3%EPSS · 30 days93.3%

2026-06-302026-07-16

KEV catalog record

Product

Sangoma / FreePBX

Vulnerability

Sangoma FreePBX Authentication Bypass Vulnerability

Added to KEV

Aug 29, 2025

Remediate by

Sep 19, 2025

Known ransomware use

Summary description

Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h ; https://nvd.nist.gov/vuln/detail/CVE-2025-57819

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2019-19006—

98.3%

KEV—80 Sangoma FreePBX Improper Authentication Vulnerability—