The authentication bypass (CVE-2019-19521) is remotely exploitable.
Source: Threadpost