CISA warns of active attacks on Signal clone TeleMessage
Take action: If you're using TeleMessage TM SGNL, start patching it today, because it's being actively exploited. Alternatively, stop using the software entirely. Switch back to standard Signal or another approved properly encrypted messaging app since TM SGNL has already been breached and continues to be attacked.
Learn More
CISA has issued a warning about two security flaws in TeleMessage TM SGNL, a Signal clone used by national security staffers and government officials. CISA has determined that these vulnerabilities are "frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise".
TeleMessage TM SGNL gained prominence following the "Signalgate" incident, when then-US national security advisor Mike Waltz inadvertently added a journalist to a Signal group chat discussing a planned March airstrike against Houthi insurgents in Yemen. The incident raised concerns about government officials potentially circumventing recordkeeping requirements through Signal's self-deleting message feature. Subsequent investigations revealed that Waltz and other officials were using TM SGNL, developed by TeleMessage (owned by US archiving company Smarsh), specifically designed to maintain records of conversations unlike standard Signal.
Security concerns emerged when journalist Micah Lee examined TM SGNL's code and discovered it was severely buggy and lacked proper end-to-end encryption that standard Signal provides. These security deficiencies were quickly exploited by data thieves who, in May 2025, published chat logs and metadata of over 60 government users on the leak site Distributed Denial of Secrets. The compromised data included communications from members of the Secret Service and at least one White House official.
The vulnerabilities currently under active exploitation include:
- CVE-2025-48927 (CVSS score 5.3): A Spring Boot Actuator misconfiguration in TM SGNL that exposes the /heapdump endpoint, allowing attackers to download memory dumps containing sensitive data.
- CVE-2025-48928 (CVSS score 4.0): A vulnerability that enables attackers with local access to the TeleMessage server to extract memory-dump files, potentially exposing passwords sent over HTTP.
CISA has not released further details about these vulnerabilities beyond stating that they have not yet been involved in any ransomware attacks. It remains unclear how many government officials continue to use the application despite security concerns.
For organizations using TeleMessage products, immediate patching is strongly recommended. If patching is not possible, CISA's guidance suggests discontinuing use of the affected software entirely.
