CVE-2019-19006: Sangoma FreePBX improper authentication in admin interface

CVE-2019-19006 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2026-02-03

Sangoma FreePBX, a widely used open-source communication platform for managing VoIP phone systems, contains a critical security flaw. This vulnerability allows an unauthorized person to bypass the login screen and gain full administrative access to the system over the internet. An attacker could take control of the phone system, intercept calls, or disrupt business communications.

Technologies: Sangoma FreePBX. Vendors: Sangoma.

Quick answers

Is CVE-2019-19006 exploited in the wild?
Yes. CVE-2019-19006 is known to be exploited in the wild, first recorded on 3 February 2026. Treat it as urgent.
How severe is CVE-2019-19006?
Critical severity, with a CVSS score of 9.8, published 3 February 2026.
Which products and versions are affected?
Sangoma FreePBX 15.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below.
Is there a fix for CVE-2019-19006?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-19006 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2019-19006?
Check whether you run Sangoma FreePBX at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper authentication vulnerability (CWE-287) exists in Sangoma FreePBX versions 13, 14, and 15. The flaw allows a remote, unauthenticated attacker to bypass the administrative login mechanism via the network without any user interaction. Successful exploitation grants the attacker full administrative privileges over the FreePBX web interface. This vulnerability has been observed being exploited in the wild to compromise Asterisk-based servers. Users should update to versions above 15.0.16.26, 14.0.13.11, or 13.0.197.13 as appropriate.

Affected products

  • Sangoma FreePBX 15.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below

Timeline

  • 2019-11-20: advisory: Vendor security advisory published
  • 2020-08-24: other: CWE classification updated by NIST
  • 2026-02-03: kev added: Added to CISA Known Exploited Vulnerabilities catalog

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.