Exploited Vulnerabilities DailyCVE-2025-57819: Sangoma FreePBX
EPSS86.3%No. 535 of 1739 in KEV
CVE year2025listed the same year
Same vendor in KEV4
Same product3
| Field | Value |
|---|---|
| Vendor | Sangoma |
| Product | FreePBX |
| Name | Sangoma FreePBX Authentication Bypass Vulnerability |
| Added to KEV | 2025-08-29 |
| US federal due date | 2025-09-19 |
| Ransomware use | Unknown |
| CWE | CWE-89, CWE-288 |
CISA description
Sangoma FreePBX contains an authentication bypass vulnerability due to insufficiently sanitized user-supplied data allows unauthenticated access to FreePBX Administrator leading to arbitrary database manipulation and remote code execution.
Other entries for this product
| CVE | Vendor / product | Added | EPSS | Ransomware |
|---|---|---|---|---|
| CVE-2025-64328 | Sangoma FreePBX | 2026-02-03 | 84.6% | Unknown |
| CVE-2019-19006 | Sangoma FreePBX | 2026-02-03 | 55.9% | Unknown |
Data from CISA's Known Exploited Vulnerabilities (KEV) catalog. EPSS is FIRST's estimated probability of exploitation activity in the next 30 days, refreshed weekly. Always follow the vendor's official guidance.
About this page
A Sangoma FreePBX vulnerability added to CISA's Known Exploited Vulnerabilities catalog on 2025-08-29.