CISA adds exploited FreeSWITCH bug CVE-2026-116779, due November 12

CISA has added an exploited FreeSWITCH flaw to its known-exploited catalog. The entry is CVE-2026-116779, a code-injection bug in SignalWire FreeSWITCH, and the due date is November 12.

The catalog names a code-injection bug. CISA added the entry on November 9 and titled it the SignalWire FreeSwitch Code Injection Vulnerability. The required action is to apply the vendor's mitigations, or to stop using the product if those mitigations are not available. The entry also tells agencies to follow CISA's guidance on prioritizing security updates by risk, and its forensics triage requirements, and to check each asset's internet exposure.

The vendor says version 1.11.3 fixes the flaw. The National Vulnerability Database lists SignalWire FreeSWITCH versions before 1.11.3 as affected. The vendor advisory lists affected versions as 1.11.2 and earlier, and patched versions as 1.11.3 and later. The database describes FreeSWITCH as a software telecom stack that runs on commodity hardware. Its description says an inbound SIP message can reach a path that runs FreeSWITCH API commands, including operating-system command functions, with the privileges of the FreeSWITCH process.

The description says exploitation has been observed. It says the flaw can expose configuration and credentials, allow arbitrary call control, and run commands, and that exploitation has been observed in the wild. The vendor advisory, published October 28, says exploitation of this path has been observed in the wild and labels the severity critical. The database says inbound chat is enabled on the stock internal and external profiles, and that any authenticated profile account is enough to reach the path. It says some stock directory users that carry no password material can remove that barrier in affected configurations.

NVD has not published a NIST score. The page says the entry is still being enriched, and the NIST base score is not available. The numbering authority named on that page lists privileges required as none and publishes the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The database entry was published on November 5 and modified on November 9, the day CISA added it.

The due date is November 12. That is the date in the catalog entry. The vendor's patched version is 1.11.3. The fetched database entry does not list a separate workaround.