CVE-2026-116779
SignalWire FreeSwitch Code Injection Vulnerability
What is it?
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock…
Official description from NVD.
What happened
CISA added CVE-2026-123218 and CVE-2026-116779 affecting IBM Aspera Faspex and SignalWire FreeSwitch to its Known Exploited Vulnerabilities catalog. Both vulnerabilities are exploited in active attacks. Federal agencies must patch within three days. Prioritize patching if you deploy these products in internet-facing environments.
From the Intel60 brief of Nov 10, 2026. AI-written summary: check the sources before acting.
Intel60 briefs
- CriticalCISA adds IBM Aspera Faspex to KEVNov 10, 2026
- CriticalCISA adds SignalWire FreeSwitch injection to KEVNov 9, 2026