Sangoma · FreePBX

CVE-2019-19006

Sangoma FreePBX Improper Authentication Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 56%

What it is

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

CISA: Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.

What to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: February 24, 2026

Added to the CISA list: February 3, 2026
Published: November 21, 2019
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 56% in the top 1.0% of all known vulnerabilities
Weakness: CWE-287
More details: NVD · CVE.org · CISA

All references (4)

More exploited flaws from Sangoma

Added	Vulnerability	Product	Severity	Attack chance
Feb 3, 2026	FreePBX OS Command InjectionCVE-2025-64328	FreePBX	High 8.6	85%
Aug 29, 2025	Authentication BypassCVE-2025-57819	FreePBX	Critical 10.0	95%
Sep 2, 2026	SQL InjectionCVE-2026-9586	Switchvox	Critical 9.3	19%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.