Skip to content
Critical CVE-2026-116779 in FreeSWITCH: Active Exploitation Confirmed

Critical CVE-2026-116779 in FreeSWITCH: Active Exploitation Confirmed

First seen 11 Nov 2026, 21:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 11, 2026 at 21:44 UTC
  • •CVE-2026-116779 affects FreeSWITCH versions up to 1.11.2, allowing remote code execution.
  • •Exploitation has been confirmed in the wild, with public proof-of-concept code available.
  • •CISA added the vulnerability to its KEV catalog on November 9, 2026, urging immediate action.

CVE-2026-116779 is a critical vulnerability affecting SignalWire FreeSWITCH versions up to 1.11.2, with a CVSS score of 9.8. The flaw allows unauthenticated remote code execution via crafted SIP MESSAGE requests, potentially leading to command execution, credential disclosure, and call manipulation. SignalWire confirmed exploitation in the wild, prompting CISA to add it to its Known Exploited Vulnerabilities catalog on November 9, 2026. Public proof-of-concept code has been released, increasing the risk of attacks. Users are advised to upgrade to FreeSWITCH version 1.11.3 or later to mitigate the risk. If immediate patching is not possible, disabling inbound SIP chat on unneeded profiles is recommended. The vulnerability was disclosed on November 5, 2026, and has been rated critical due to its severe impact on systems reachable from untrusted networks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 6h ago How this analysis works

Timeline

2026-11-05
CVE-2026-116779 published
SignalWire disclosed a critical vulnerability in FreeSWITCH affecting versions up to 1.11.2.
Bitsight
2026-11-09
CISA adds CVE-2026-116779 to KEV
CISA included the vulnerability in its Known Exploited Vulnerabilities catalog due to active exploitation.
Bitsight
2026-11-10
Public PoC code released
Proof-of-concept code for CVE-2026-116779 became publicly available, increasing exploitation risk.
Buttondown

More articles in this cluster (3)

Following this threat?

Track CISA and CVE-2026-116779 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (13)

1 / 4

Common questions

Which versions of FreeSWITCH are affected?
FreeSWITCH versions up to 1.11.2 are affected by CVE-2026-116779.
Is there evidence of active exploitation?
Yes, exploitation of CVE-2026-116779 has been confirmed in the wild.
What should organizations do to protect themselves?
Organizations should upgrade to FreeSWITCH version 1.11.3 or later immediately.