CVE-2019-19006

CRITICAL KEV

Sangoma FreePBX <115.0.16.26, <14.0.13.11, <13.0.197.13 - Info Disc...

Title source: llm

CVE-2019-19006 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added February 3, 2026.

Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.

Core 6

Core References

Product x_refsource_misc

Vendor Advisory x_refsource_confirm

Vendor Advisory x_refsource_misc

Broken Link x_refsource_misc

Exploit, Third Party Advisory

US Government Resource

CVSS v3 9.8

EPSS 0.2164

EPSS Percentile 95.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnrichment

Exploitation active

Automatable yes

Technical Impact total

CISA KEV 2026-02-03

VulnCheck KEV 2020-11-05

InTheWild.io 2020-11-05

ENISA EUVD EUVD-2019-8659

CWE

CWE-287

Status published

Products (1)

sangoma/freepbx 13.0.0.0 - 13.0.197.13

Published Nov 21, 2019

KEV Added Feb 03, 2026

Tracked Since Feb 18, 2026