Is CVE-2026-116789 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116789 being exploited in the wild.

How severe is CVE-2026-116789?

High severity, with a CVSS score of 7.4, published 5 November 2026.

Which products and versions are affected?

SignalWire FreeSWITCH before 1.11.2.

How is CVE-2026-116789 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-116789?

Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116789: FreeSWITCH DTLS fingerprint validation bypass in server role

CVE-2026-116789 · Severity: high · CVSS 7.4 · Published 2026-11-05

FreeSWITCH is a software-based phone system used to handle voice and video calls over IP networks. An attacker able to reach the media port can intercept and impersonate legitimate call participants by sending specially crafted DTLS handshake packets, allowing them to eavesdrop on or inject audio and video into calls. This affects calls where FreeSWITCH acts as the DTLS server, which is common in WebRTC and SIP scenarios.

Technologies: SignalWire FreeSWITCH. Vendors: SignalWire.

Quick answers

Is CVE-2026-116789 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116789 being exploited in the wild.
How severe is CVE-2026-116789?: High severity, with a CVSS score of 7.4, published 5 November 2026.
Which products and versions are affected?: SignalWire FreeSWITCH before 1.11.2.
Is there a fix for CVE-2026-116789?: Yes: fixed in FreeSWITCH 1.11.2. Until then: Enable DTLS client certificate verification by setting the channel variable rtp_dtls_client_cert_verify_mode=fingerprint before establishing calls; this enforces fingerprint validation even on patched versions and is required as of version 1.11.2 for server-role protection. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116789 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-116789?: Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: FreeSWITCH 1.11.2

Enable DTLS client certificate verification by setting the channel variable rtp_dtls_client_cert_verify_mode=fingerprint before establishing calls; this enforces fingerprint validation even on patched versions and is required as of version 1.11.2 for server-role protection.

Technical details

The dtls_state_setup() function failed to validate peer certificates against the SDP a=fingerprint value when FreeSWITCH held the DTLS server role, though it did validate them in the client role. An unauthenticated attacker with network access to the media port can complete a DTLS-SRTP handshake using an unrelated certificate to obtain the session's SRTP keys. On ICE-enabled calls, the attacker also needs connectivity-check credentials from the SDP, typically requiring signaling visibility or network position on the signaling path.

Affected products

SignalWire FreeSWITCH before 1.11.2

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.