Is CVE-2026-116790 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-116790 being exploited in the wild.

How severe is CVE-2026-116790?

Critical severity, with a CVSS score of 9.1, published 5 November 2026.

Which products and versions are affected?

SignalWire FreeSWITCH before 1.11.2.

How is CVE-2026-116790 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-116790?

Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-116790: FreeSWITCH ICE integrity validation bypass

CVE-2026-116790 · Severity: critical · CVSS 9.1 · Published 2026-11-05

FreeSWITCH is a software telephone switching system that processes voice and video calls over IP networks. Prior to version 1.11.2, attackers on the network could forge ICE connectivity checks without proper cryptographic validation, allowing them to hijack media streams, intercept calls, or inject fake audio/video. WebRTC and SIP calls using ICE are particularly at risk.

Technologies: SignalWire FreeSWITCH. Vendors: SignalWire.

Quick answers

Is CVE-2026-116790 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-116790 being exploited in the wild.
How severe is CVE-2026-116790?: Critical severity, with a CVSS score of 9.1, published 5 November 2026.
Which products and versions are affected?: SignalWire FreeSWITCH before 1.11.2.
Is there a fix for CVE-2026-116790?: Yes: fixed in 1.11.2. Until then: Enable MESSAGE-INTEGRITY verification by setting the ice_verify_message_integrity channel variable to true in the FreeSWITCH configuration, though this remains opt-in and disabled by default even in patched versions. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-116790 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-116790?: Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.11.2

Enable MESSAGE-INTEGRITY verification by setting the ice_verify_message_integrity channel variable to true in the FreeSWITCH configuration, though this remains opt-in and disabled by default even in patched versions.

Technical details

The vulnerability exists in inbound ICE handling where STUN MESSAGE-INTEGRITY attributes are not validated before accepting connectivity checks. An attacker with network access to the media port can forge ICE checks, nominate a malicious address, and redirect RTP and DTLS traffic, terminating the legitimate media path. On unencrypted media legs, this enables eavesdropping and media injection; all WebRTC and SIP ICE-enabled legs are in scope. The fix in v1.11.2 adds optional HMAC-SHA1 MESSAGE-INTEGRITY verification gated behind the ice_verify_message_integrity channel variable.

Affected products

SignalWire FreeSWITCH before 1.11.2

Timeline

2026-11-05: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.