Sangoma Patches Critical Zero-Day Exploited to Hack FreePBX Servers

Sangoma has issued emergency patches for a zero-day vulnerability that was exploited to hack FreePBX servers, tracked as CVE-2025-57819 with a CVSS score of 10/10. The flaw stems from insufficient sanitization of user-supplied data, and successful exploitation can grant access to the FreePBX administrator panel, enabling database manipulation and remote code execution. Fixes were rolled out for FreePBX versions 15, 16, and 17 after Sangoma found the defect had been exploited in the wild on or before 21 August.

The advisory notes that the hacked servers lacked adequate IP filtering or ACLs, with an incident linked to the commercial “endpoint” module. Administrators are urged to lock down administrator access and remote internet access to FreePBX servers, ensure they are firewall-protected, update to patched versions, and check that the endpoint module receives the recommended fixes; Sangoma also provides indicators-of-compromise and restoration steps.

On Friday, according to CISA, CVE-2025-57819 was added to the Known Exploited Vulnerabilities catalog, with federal agencies urged to patch by 19 September under Binding Operational Directive 22-01.