CISA adds exploited FreeSwitch code injection flaw to KEV catalogue

CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities (KEV) catalogue on 9 November 2026. The flaw affects SignalWire FreeSwitch and is a code injection vulnerability that can disclose configuration and credentials, enable arbitrary call control and allow command execution.

The vulnerability is described as code injection. Its listed impacts include disclosure of configuration and credentials, arbitrary call control and command execution; the available data does not specify the attack vector. It has a CVSS score of 9.8, rated Critical. Patch status is unknown, and no patch or advisory URL is provided in the supplied data. SignalWire’s security advisory contains further information.

CISA’s KEV listing indicates that the vulnerability has been exploited. Use in ransomware campaigns is unknown. CISA set a remediation deadline of 12 November 2026.

CISA directs affected Federal Civilian Executive Branch (FCEB) agencies to apply mitigations in accordance with vendor instructions, while following applicable BOD 26-04 guidance on prioritising security updates and CISA’s Forensics Triage Requirements. Where mitigations are unavailable, agencies should discontinue use of the product. Stakeholders should evaluate each asset’s internet exposure and comply with BOD 26-04 patching guidance. All organisations should review their exposure to FreeSwitch and assess whether the component is present in their environments.

For full details, consult the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-116779) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog).