CVE-2019-19006 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2019-11-21

Added to CISA KEV: 2026-02-03 2266 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity
Immediately update FreePBX to versions: 15.0.16.27+, 14.0.13.12+, or 13.0.197.14+
Monitor FreePBX admin interface logs for suspicious authentication activity or configuration changes
Consider restricting admin interface access to internal networks only if remote access is not required
PATCH PRIORITY: CRITICAL - Exploit requires no authentication and provides full administrative access

🔍 Web Intelligence (Kagi · 2026-06-04)

CVE-2019-19006 is an improper authentication vulnerability affecting Sangoma FreePBX, a widely used open-source IP PBX (Private Branch Exchange) system ^[1] ^[2].

Key Details

Feature	Status
Active Exploitation	Yes, it is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog as of February 2026 ^[3].
Attack Vector	Remote (Network-based) ^[2].
User Interaction	Not required.
Impact	Authentication bypass, allowing unauthorized access to the administrative interface.
Affected Versions	FreePBX 15.0.16.26 and below, 14.0.13.11 and below, and 13.0.197.13 and below ^[1].

Analysis

Active Exploitation & Threat Actors: As of February 2026, CISA formally added this vulnerability to its KEV catalog due to evidence of active exploitation in the wild ^[3]. While specific threat actor campaigns are not always detailed in public CVE databases, vulnerabilities in PBX systems are frequently targeted for unauthorized access, toll fraud, and monetization through the hijacking of telephony infrastructure ^[2].
Attack Method: The vulnerability stems from incorrect access control within the FreePBX administrative framework. It allows a remote, unauthenticated attacker to bypass authentication mechanisms and gain administrative access to the system ^[1].
Impact: Successful exploitation grants an attacker administrative control over the FreePBX instance. This can lead to full system compromise, including the ability to modify system configurations, intercept communications, or use the PBX for malicious activities such as toll fraud.
Mitigation & Patch Status: Users are strongly advised to update to a version of FreePBX that contains the fix. Sangoma provided guidance and patches shortly after the vulnerability's disclosure in late 2019 ^[2]. Organizations should verify their current version and apply all available security updates immediately. If patching is not immediately possible, restricting access to the administrative interface to trusted IP addresses via firewall rules is a critical compensating control.

Sources