The vulnerability CVE-2026-10629 affects Verizon's VoLTE SIP signaling stack by omitting IPsec integrity protections, specifically missing Security-Client/Security-Server headers and ESP traffic. This results in unsecured SIP signaling messages that can be intercepted and altered by an attacker positioned on the communication path. The flaw relates to CWE-346 (Origin Validation Error) and CWE-523 (Unprotected Transport of Credentials), enabling compromise of the confidentiality, integrity, and authenticity of VoLTE signaling. No specific affected versions or vendor remediation details are provided. The CVSS 3.1 base score is 7.4, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality and integrity impact but no availability impact.

An attacker with on-path access to the radio or core network can passively monitor and actively manipulate VoLTE SIP signaling messages due to missing IPsec protections. This compromises the confidentiality, integrity, and authenticity of signaling data, potentially enabling interception or tampering with voice call signaling. Availability is not impacted. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory at https://www.kb.cert.org/vuls/id/615987 for current remediation guidance. No official fix or workaround is currently documented. Until a fix is available, network operators should consider additional protective measures such as securing signaling channels with IPsec or equivalent integrity protections if feasible.