Sangoma FreePBX Improper Authentication Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2019-19006 · Published 21/11/2019 · updated 17/06/2026

Sangoma FreePBX Improper Authentication Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/02/2026. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
freepbx sangoma	`≥ 13.0.0.0, ≤ 13.0.197.13≥ 14.0.0.0, ≤ 14.0.13.11≥ 15.0.0.0, ≤ 15.0.16.26`	No fix yet

Description

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

References

community.freepbx.org/t/freepbx-security-vulnerability-sec-2019-001/62772 · Vendor Advisory
pastebin.com/2CdsQMKW · Broken Link
wiki.freepbx.org/display/FOP/2019-11-20+Remote+Admin+Authentication+Bypass · Vendor Advisory
freepbx.org/category/blog · Product
research.checkpoint.com/2020/inj3ctor3-operation-leveraging-asterisk-servers-for-monetization · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2019-19006

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free