Critical FreeSWITCH Vulnerability CVE-2026-116779 Exploited in the Wild
CVE-2026-116779, a critical vulnerability in SignalWire FreeSWITCH, is being exploited. Users should upgrade to version 1.11.3 or later.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
CVE-2026-116779 is a critical vulnerability in FreeSWITCH.
Who is affected
SignalWire FreeSWITCH versions up to 1.11.2.
Exploited
Exploitation confirmed in the wild.
What to do
Upgrade to FreeSWITCH version 1.11.3 or later.
CVE-2026-116779 is a critical vulnerability affecting SignalWire FreeSWITCH versions up to 1.11.2. This flaw allows unauthenticated remote code execution through crafted SIP MESSAGE requests.
Successful exploitation of this vulnerability can result in command execution, credential disclosure, and call manipulation. The vulnerability was disclosed on November 5, 2026.
CISA has confirmed that this vulnerability is being exploited in the wild and added it to its Known Exploited Vulnerabilities catalog on November 9, 2026.
Public proof-of-concept code for CVE-2026-116779 has been released, increasing the urgency for mitigation.
Users are advised to upgrade to FreeSWITCH version 1.11.3 or later to address this critical security issue.
