CVE-2019-19006
Published 2019-11-21 · Updated 2026-06-17 · Source cve@mitre.org
Summary
CVE-2019-19006 is a critical-severity (CVSS 9.8) vulnerability in Sangoma FreePBX. CISA added it to the Known Exploited Vulnerabilities catalog on February 3, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by February 24, 2026. CISA does not currently list it as used in ransomware campaigns. Sangoma has 4 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.
All 4 known-exploited Sangoma vulnerabilities →Description
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA Known-Exploited Vulnerability
Product: Sangoma — FreePBX
Name: Sangoma FreePBX Improper Authentication Vulnerability
Date added: 2026-02-03 · Due: 2026-02-24
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
References
- https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772
- https://pastebin.com/2CdsQMKW
- https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+Bypass
- https://www.freepbx.org/category/blog/
- https://community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772
- https://pastebin.com/2CdsQMKW
- https://wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+Bypass
- https://www.freepbx.org/category/blog/