Actively exploited in the wild

Sangoma FreePBX Improper Authentication Vulnerability

Sangoma — FreePBX · Listed in the CISA KEV since 2026-02-03. This indicates confirmed attacks in production environments.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CVE-2019-19006

CriticalCVSS 9.8KEV

Published: 21/11/2019(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Very high risk

35.79%

98th percentile — higher than 98% of all known CVEs

Summary

Versions of Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, and 13.0.197.13 and below have incorrect access control.

Risk Assessment

Incorrect access control may lead to unauthorized access to the system, posing a risk to the organization's data security.

Recommendation

It is recommended to upgrade to the latest version of FreePBX to mitigate this vulnerability.

Original NVD description (English source)

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.