FreeSWITCH CVE-2026-116779: advisory of 28 Oct says exploited; the 1.11.3 fix release was 61 days earlier

SignalWire's advisory for FreeSWITCH CVE-2026-116779 says exploitation of the flaw has been observed in the wild. The 1.11.3 release page shows the fix shipped on 28 August, 61 days (derived) before the 28 October advisory; CISA listed it on 9 November, 73 days (derived) after the release.

By Parminder Kumar Sharma · LinkedIn · 10 Nov 2026, 15:03 GMT · 18 min read

A restaurant kitchen pass at night. A brushed steel ticket rail above the pass holds a row of identical blank paper order tickets, and one in the middle is lit warm amber by a heat lamp. A brass service bell stands on the steel shelf below, and a dim hob with dark pans sits out of focus behind. The headline reads: FreeSWITCH: advisory of 28 Oct says exploited; the fix was released 61 days earlier. Stat: 61 days, derived.

This article could not be displayed.

Its content contains a formatting error. The error has been logged and the article will be restored once it is corrected.

Sources

PrimaryGHSA-mg63-h38w-8p9p, published 28 October 2026 by page data: mechanism, prerequisites, impact, workarounds, fix, the exploitation sentence. Read in fullSignalWire (GitHub security advisory)accessed 2026-11-10
PrimaryFreeSWITCH v1.11.3 release page, 28 Aug 22:27 UTC by page data: release notes including the enable-chat-api-proto lines. Read in fullSignalWire (GitHub release)accessed 2026-11-10
PrimaryPull request 3135, merged 26 August 2026: the change and its description, label and mentions. Read in fullSignalWire (GitHub pull request)accessed 2026-11-10
PrimaryCommit 7015f6a: the configuration comment and the log message format. Read in fullSignalWire (GitHub commit)accessed 2026-11-10
PrimaryCVE record CVE-2026-116779: reserved 26 October, published 5 November 2026, CISA coordinator data. Read in fullCVE Program (GitHub as CNA, CISA ADP)accessed 2026-11-10
PrimaryNVD record CVE-2026-116779: published 5 November 2026, score source, CPE match. Read in fullNIST National Vulnerability Databaseaccessed 2026-11-10
PrimaryKnown Exploited Vulnerabilities catalogue, version 2026.11.09: entry, due date and flags, and the count of forensicTriage entriesCISAaccessed 2026-11-10
PrimaryBOD 26-04, 10 June 2026: scope and the meaning of forensic triage. Read in fullCISAaccessed 2026-11-10
PrimaryBOD 26-04 implementation guidance, 10 June 2026: forensic triage steps. Read in fullCISAaccessed 2026-11-10
Reported byIBM Aspera Faspex, SignalWire FreeSwitch Vulnerabilities Exploited in Attacks, 10 November 2026 by page data: a secondary used to compare reporting, and for no figureSecurityWeekaccessed 2026-11-10

Share this briefing

Know someone who owns this problem? Send it to them.

LinkedIn X WhatsApp Email

Related briefings

A church organ workshop at night in cool blue moonlight. On the right a wooden wind chest holds ranks of identical blank pewter organ pipes with one empty socket in the middle rank, and a single pipe lying on a green felt bench beside blank cream paper tags on string, a tuning cone and a small amber lamp. The left half is dark and carries the headline: Onapsis: four of SAP's 43 November notes are rated 10.0; one fix is a patch plus a parameter. Stat: 4 of 43.

Threat Intel10 Nov 2026

Onapsis says SAP's 43 November notes hold four rated 10.0; PROXYGATE's fix is a patch plus a parameter

What Onapsis, SAP's CVE records and BleepingComputer say about the four CVSS 10.0 notes of SAP's November 2026 patch day, why 43, 36 and 35 are different counts, the XBOW claim, and what is not stated.

A canal lock at dusk: heavy timber mitre gates with iron straps and a slightly open near gate, a cast iron paddle gear wheel lit warm amber, a brick lock-keeper's hut with a dim window behind, a coil of rope on a bollard, still teal water. The headline reads: IBM Faspex CVE-2026-123218: text says authenticated, CVSS says no privileges; on KEV 9 Nov. Stat: 9.8, PR:N, IBM's own score and vector; exploitation detail not stated.

Threat Intel10 Nov 2026

Aspera Faspex CVE-2026-123218: IBM text says authenticated, its CVSS vector says no privileges; KEV 9 Nov

Who says authenticated, who says authorized and what the CVSS vector says, with CISA's KEV wording, the clock from 5 to 12 November, what no page states and what to do.

A histology laboratory at night. A pale grey microscope stands on the right of a steel bench with a single glass slide lit on its stage. Beside it a clear rack holds about twenty identical blank slides, and one of them has a hairline crack that catches amber light. The headline reads: Google: a Chrome XML bug has an exploit in the wild; fixed 3 days after the report. Stat: 3 days.

Threat Intel10 Nov 2026

Google: Chrome XML bug CVE-2026-125350 has an exploit in the wild; fixed in 157.0.8103.50, 3 days after report

What Google's 9 November 2026 Chrome posts say about CVE-2026-125350: an exploit in the wild, a report dated 3 days before the fix, the builds, and what is not stated, including that the Extended Stable post prints no exploitation sentence.

The briefing, in your inbox

Practitioner analysis of cyber and AI security news. No vendor noise.