Applied Cybernetics Group
Threat intel → detection pipeline
Tuesday, July 14, 2026
Data as of 20:11 UTC

Sangoma FreePBX Authentication Bypass Vulnerability

Added to KEV
2025-08-29
Federal due date
2025-09-19
Vendor
Sangoma
Product
FreePBX
EPSS
99.8th percentile (score 0.933, as of 2026-07-13)
NVD CVSS v3.1
9.8 (CRITICAL)
Ransomware use
Unknown
Upstream
https://nvd.nist.gov/vuln/detail/CVE-2025-57819

CISA short description

Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

NVD description

FreePBX is an open-source web-based graphical user interface. FreePBX 15, 16, and 17 endpoints are vulnerable due to insufficiently sanitized user-supplied data allowing unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution. This issue has been patched in endpoint versions 15.0.66, 16.0.89, and 17.0.3.

EPSS percentile is the FIRST.org exploit-probability ranking as of the date noted above; it moves daily. CVSS reflects NVD's analysis at time of publication.