Sangoma FreePBX security advisory (AV25–550)

Serial number: AV25-550
Date: August 29, 2025

On August 28, 2025, Sangoma FreePBX published a security advisory to address a critical vulnerability in the following products:

• FreePBX – versions 15 prior to 15.0.66
• FreePBX – versions 16 prior to 16.0.89
• FreePBX – versions 17 prior to 17.0.3

Open-source reporting has indicated that CVE-2025-57819 has been exploited.

The Cyber Centre encourages users and administrators to review the web links provided, apply the necessary updates and perform the suggested mitigations.

• GitHub - Authentication Bypass Leading to SQL Injection and RCE
• Security Advisory: Please Lock Down Your Administrator Access
• Endpointmanager Aug 2025 zero-day
• FreePBX Endpoint Zero-Day — incident note, detection and remediation checklist