CVE-2019-19006: listed in the CISA KEV catalog
CVE-2019-19006 · CVSS 9.8 CRITICAL · EPSS 37% · KEV 2026-02-03
Sangoma FreePBX 115.0.16.26 and below, 14.0.13.11 and below, 13.0.197.13 and below have Incorrect Access Control.
Is CVE-2019-19006 exploited?
- Listed in the CISA KEV catalog on 2026-02-03.
- Federal remediation due 2026-02-24.
- Past that date by 172 days.
- EPSS puts exploitation in the next 30 days at 37%.
- Public exploit code: none found in monitored sources.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2019-19006
PlainSec has not published a story about this CVE.
Primary sources
What this record does not say
- No affected package data.
- No patch identifier.
KEV and EPSS are re-checked daily. Record last updated 2026-08-11.