What happened
SignalWire FreeSwitch contains a code injection vulnerability, tracked as CVE-2026-116779. The flaw can permit configuration and credential disclosure, arbitrary call control and command execution. An exposed service can be attacked directly over a network, without prior access or any user involvement. Exploitation is confirmed in the wild, and the vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalogue. The severity is critical, with an NVD score of 9.8. The CVSS vector records high impact to confidentiality, integrity and availability.
Who is affected
Organisations running SignalWire FreeSwitch versions earlier than 1.11.3 are within the stated affected scope. The exploit path requires the service to be reachable over a network; no user action or prior access is required. The available information does not identify further deployment-specific scope.
Recommended actions
- Apply the available vendor fix to affected SignalWire FreeSwitch deployments.
- Restrict network exposure of the service so that it is not reachable by untrusted network sources.
- Place network segmentation around the service to limit access to it and constrain its reachability.
- Enforce access control in front of the service to restrict network access.
