ACTIVELY EXPLOITED
CVE-2019-19006: Sangoma FreePBX Improper Authentication Vulnerability
| Vendor | Sangoma |
|---|---|
| Product | FreePBX |
| Actively exploited | Yes |
| Added to CISA KEV | 3 Feb 2026 |
| CISA federal deadline | 24 Feb 2026 |
| Weakness (CWE) | CWE-287 |
Required action (CISA's text)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description (NVD)
Sangoma FreePBX contains an improper authentication vulnerability that potentially allows unauthorized users to bypass password authentication and access services provided by the FreePBX admin.
SOURCES
Other Sangoma flaws
- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability
- CVE-2025-64328: Sangoma FreePBX OS Command Injection Vulnerability
- CVE-2025-57819: Sangoma FreePBX Authentication Bypass Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.