Is CVE-2026-116786 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116786 being exploited in the wild.

How severe is CVE-2026-116786?

High severity, with a CVSS score of 8.8, published 5 November 2026.

Which products and versions are affected?

SignalWire FreeSWITCH before 1.11.2.

Is there a fix for CVE-2026-116786?

Yes: fixed in FreeSWITCH 1.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-116786 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-116786?

Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116786: FreeSWITCH command injection via SIP REFER URI parameters

CVE-2026-116786 · Severity: high · CVSS 8.8 · Published 2026-11-05

FreeSWITCH is a software-based telephone system that handles voice calls over IP networks. An authenticated SIP user can exploit a vulnerability in the REFER request handler to inject arbitrary system commands that execute with FreeSWITCH's privileges, potentially compromising the entire phone system and underlying server.

Technologies: SignalWire FreeSWITCH. Vendors: SignalWire.

Quick answers

Is CVE-2026-116786 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116786 being exploited in the wild.
How severe is CVE-2026-116786?: High severity, with a CVSS score of 8.8, published 5 November 2026.
Which products and versions are affected?: SignalWire FreeSWITCH before 1.11.2.
Is there a fix for CVE-2026-116786?: Yes: fixed in FreeSWITCH 1.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116786 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-116786?: Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FreeSWITCH 1.11.2

Technical details

The sofia_handle_sip_i_refer() function incorrectly parses attacker-controlled Refer-To URI parameters by inserting them into a comma-delimited variable block, allowing variable injection through comma characters. An authenticated caller on a bridged call can inject an execute_on_originate variable to invoke the system dialplan application and execute OS commands before the call is answered. The fix isolates sip_invite_params in the originate event's ovars structure to prevent comma-based parsing attacks.

Affected products

SignalWire FreeSWITCH before 1.11.2

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.