# CVE-2026-116779: SignalWire FreeSwitch Code Injection Vulnerability

- Exploited (CISA KEV): yes, added 2026-11-09
- Published: unknown
- CVSS: not scored
- EPSS: 1.3% (71th percentile)
- CWE: CWE-77, CWE-78, CWE-749

SignalWire FreeSwitch contains a code injection vulnerability that permits configuration and credential disclosure, arbitrary call control, and command execution.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| Vercel | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

62 posts seen since 2026-11-01.

- Exploit repository (unvetted): https://github.com/hackzuoji/freeswitch-cve-2026-116779-POC
- Exploit repository (unvetted): https://github.com/majidrahimi5020-lgtm/Poc-exploit-for-CVE-2026-116779-FreeSWITCH-
- mastodon 2026-11-09: Placeholder for future CISA blog post: https://www. cisa.gov/news-events/alerts/20 26/11/09/cisa-adds-three-known-exploited-vulnerabilities-catalog KEV Catalog already shows 3 new CVEs: CVE-2026-116779 SignalWire FreeSwitch Code Injection Vulnerability CVE-2026-123158 (aka sshho… (https://infosec.exchange/@ssvc/117587842105930939)
- mastodon 2026-11-09: Signalwire Freeswitch zero-day: CVE-2026-116779 OS Command Injection Exploitation of this path has been observed in the wild. https:// github.com/signalwire/freeswit ch/security/advisories/GHSA-mg63-h38w-8p9p # signalwire # zeroday # CVE # eitw (https://infosec.exchange/@ssvc/117587278212918590)
- bluesky 2026-11-06: 🌊 ABYSSAL · critical with a public exploit CVE-2026-116779: FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands CVSS 9.8 https://vulnsea.com/cve/CVE-2026-116779  #CVE #infosec #cybersecurity #threatintel (https://bsky.app/profile/vulnsea.com/post/3mzmxpnpu5i2d)
- x 2026-11-05: 🚨 Public exploit out signalwire freeswitch: 2 critical CVEs Worst: unauthenticated command execution in SIP MESSAGE handling (CVE-2026-116779) public exploit: CVE-2026-116779 Patch → see advisories https://t.co/Zu23X0HyBi (https://x.com/cvedotnow/status/2118429810921771338)
- x 2026-11-09: 🚨 CVE-2026-116779 — CRITICAL — actively exploited per CISA KEV SignalWire FreeSwitch  CVSS 9.8 \| EPSS 1%  #CVE https://t.co/zFTgweKtIL (https://x.com/threatpodium/status/2119894376105070782)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-116779 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-116779