CRITICAL Zero-Day CVE-2025-57819 in FreePBX Is Under Active Attack (CVSS 10.0)

The Sangoma FreePBX Security Team has issued a critical advisory about a newly discovered vulnerability in FreePBX, tracked as CVE-2025-57819 with a maximum CVSSv4 score of 10.0. The flaw allows unauthenticated attackers to bypass login protections, manipulate the database, and achieve remote code execution, with exploitation already observed in the wild starting on or before 21 August 2025.

The advisory notes that the vulnerability affects all supported FreePBX versions 15, 16 and 17, exposing thousands of internet-facing PBX systems to compromise, including the ability to take full control of the PBX server, intercept calls, and steal sensitive configuration data. Upgrades are urged: FreePBX 15 to 15.0.66, FreePBX 16 to 16.0.89, and FreePBX 17 to 17.0.3, which administrators can apply via the web interface or the command line using fwconsole commands.

The article also highlights network-level restrictions and recommends checking for red flags such as unexpected modifications to /etc/freepbx.conf or the presence of /var/www/html/.clean[.]sh, and it stresses that CVE-2025-57819 is one of the most serious vulnerabilities seen in FreePBX to date.