CISA adds SignalWire FreeSwitch injection to KEV

SignalWire FreeSwitch contains a code injection vulnerability enabling credential disclosure, arbitrary call control, and command execution. CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog. Federal agencies must apply vendor mitigations by November 12, 2026, following BOD 26-04 guidance or discontinue use if patches are unavailable. Defenders should prioritize patching this widely-deployed VoIP component.