The vulnerability CVE-2026-10629 affects Verizon's VoLTE SIP signaling stack by lacking IPsec integrity protection mechanisms such as Security-Client/Security-Server headers and ESP traffic. This results in an origin validation error (CWE-346) and insufficient integrity protection (CWE-523), enabling an on-path attacker to intercept and manipulate SIP signaling messages within the IMS network. The vulnerability impacts the confidentiality, integrity, and authenticity of VoLTE signaling communications. No specific affected versions or vendor remediation details have been provided, and no CVSS score is assigned.

An attacker positioned on the communication path can compromise the confidentiality, integrity, and authenticity of VoLTE signaling messages by exploiting the lack of IPsec integrity protection. This could allow passive monitoring or active manipulation of SIP signaling over the radio and core network, potentially undermining secure voice communication. However, no known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://www.kb.cert.org/vuls/id/615987 for current remediation guidance. Until an official fix or mitigation is provided by Verizon or CERT, users should be aware of the risk but no specific mitigation steps are documented.