Vulnerability intelligence
CVE-2019-19006
Sangoma FreePBX Improper Authentication Vulnerability
Sangoma FreePBX
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
CVSS Score
—
Unrated
EPSS — Exploit Probability
37%
Riskier than 98% of all CVEs · checked 2026-09-09
Exploitation
Confirmed in the wild
KEV since 2026-02-03
Remediation
Unconfirmed
Federal deadline 2026-02-24
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2026-02-24.
2 articles across 2 outlets · first covered Feb 3, 2026 · latest Feb 4, 2026
Coverage timeline
-
Fresh SolarWinds Vulnerability Exploited in Attackswww.securityweek.com · Feb 4, 2026
-
U.S. CISA adds SolarWinds Web Help Desk, Sangoma FreePBX, and GitLab flaws to its Known Exploited Vulnerabilities catalogsecurityaffairs.com · Feb 3, 2026