The Cybersecurity and Infrastructure Security Agency added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog on 2026-11-09. The National Vulnerability Database assigns this SignalWire FreeSwitch vulnerability a CVSS base score of 9.8.

Is CVE-2026-116779 being exploited?

The National Vulnerability Database confirms exploitation occurred in the wild. PurpleOps recorded 2 exploit-feed entries for this vulnerability. The first exploit-feed entry surfaced on 2026-11-06, which was exactly 3 days before the catalog listing. An analyzed file named fscve/core.py provides logic for detecting the flaw and implementing an attack path. This module establishes a transport via TCP or UDP, handles SIP messages with optional digest authentication, and executes a system command on the target. The file then retrieves the output through a DNS-based exfiltration channel. PurpleOps data assigns this threat a risk score of 99 out of 100 based on ease of use, potential impact, how widely it spreads, and whether special access or user actions are needed. No indicators of compromise appear in the public reporting we collected.

Who is affected?

FreeSwitch is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Versions of the software prior to 1.11.3 are vulnerable. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H indicates the flaw is reachable over the network, requires no privileges, requires no user interaction, has low attack complexity, and causes a total loss of confidentiality, integrity, and availability.

The vulnerability exists because sofia_presence_handle_sip_i_message splits the To user of an inbound SIP MESSAGE on a plus sign and treats the left side as a chat protocol selector. Selecting the api chat protocol reaches switch_api_execute, allowing a peer whose message the software accepted to run API commands with the daemon privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient to reach the vulnerable code. Stock directory users without password material remove that barrier in affected configurations.

This defect introduces the assigned weakness class CWE-749. It also causes CWE-77 command injection, where input passes into a command string without neutralization, allowing an attacker to add commands the developer never intended in the product. The flaw creates CWE-78 OS command injection because attacker-controlled input concatenates into a shell command without neutralization, so appended metacharacters run additional commands as the service account. These issues permit configuration and credential disclosure, arbitrary call control, and command execution.

How do I detect it?

Because public reporting lacks indicators of compromise, defenders must rely on behavioral hunt leads. Security teams must monitor web or application access logs for the affected service, kept at full request detail. Defenders should also collect process creation logs for the hosts running the software, specifically auditd execve on Linux and Sysmon event 1 on Windows.

Analysts must review outbound network connection logs from those hosts. Hunt for the service process starting an interpreter or shell. Teams must also hunt for files written into directories the application can execute, alongside outbound connections from the host to addresses it has never contacted before. If a hunt lead hits, capture the service logs and a memory image before restarting the process. Responders must rotate the credentials and tokens the host held and compare the files against a known-good deployment before returning the system to production.

The following detection rule identifies a web server or application server process starting a shell or scripting interpreter. Allow-list the maintenance jobs that legitimately run under the service account, by command line, to tune the rule for false positives.

title: Web Service Process Spawning a Shell or Interpreter
id: a50869ab-edeb-46b0-96ca-df4922bdb116
status: experimental
description: Detects a web server or application server process starting a shell or scripting interpreter, the first observable step after remote code execution in a web application.
logsource:
  category: process_creation
detection:
  selection_parent:
    ParentImage|endswith:
      - '\w3wp.exe'
      - '\httpd.exe'
      - '\nginx.exe'
      - '\java.exe'
      - '\node.exe'
      - '/httpd'
      - '/apache2'
      - '/nginx'
      - '/java'
      - '/node'
  selection_parent_php:
    ParentImage|contains: '/php-fpm'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '/sh'
      - '/bash'
      - '/dash'
      - '/python3'
      - '/perl'
  condition: (selection_parent or selection_parent_php) and selection_child
falsepositives:
  - Application maintenance or deployment scripts launched by the web service account
level: high

What should I patch first?

The federal remediation due date for this vulnerability is 2026-11-12. The mandated required action states federal agencies must apply mitigations in accordance with vendor instructions. Administrators must ensure compliance with BOD 26-04 Prioritizing Security Updates Based on Risk guidance and Forensics Triage Requirements. Organizations must follow applicable guidance for cloud services or discontinue use of the product if mitigations are unavailable.

Read the PurpleOps blog to review additional threat data. Security teams automate these behavioral hunt leads and isolate compromised hosts using BUGSY and JINX, delivered as AI analysts.