Dashboard / CVE-2025-57819

CVE-2025-57819

CISA KEV
ACT NOW Priority: 0.00 BB Relevance: 10/100
Published: N/A Modified: N/A First seen: 2026-10-29 Status: pending_score

Description

Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.

CISA Known Exploited Vulnerability

Vendor / Product Sangoma — FreePBX
Date Added 2025-08-29
Remediation Due 2025-09-19
https://github.com/FreePBX/security-reporting/security/advisories/GHSA-m42g-xg4c-5f3h ; https://nvd.nist.gov/vuln/detail/CVE-2025-57819

Weakness Classification (2)

Affected Software (3)

VendorProductVersion
sangoma freepbx 15.0 – 15.0.66
sangoma freepbx 16.0 – 16.0.89
sangoma freepbx 17.0 – 17.0.3

References & Advisories (4)

Bug Bounty Relevance

10 / 100
✓ Known exploited (KEV)
✓ High exploitation probability

CVSS Score

Unscored

EPSS — Exploitation Probability

95.21%
Raw Score 0.952130
Percentile 99.9%
Date 2026-10-29

EPSS Trend

2026-10-29
0.95213
2026-10-28
0.95213

Intelligence Sources

kev ref →

External Links