CISA Warns of Active Exploitation of TeleMessage TM SGNL Memory-Dump Flaws
Active Exploitation · 3 sources · Updated 4h ago · First seen Jul 2, 2025
CISA added two vulnerabilities in TeleMessage TM SGNL, a Signal clone used to archive communications by government personnel, to its Known Exploited Vulnerabilities Catalog after confirming active exploitation. CVE-2025-48927 and CVE-2025-48928 expose sensitive information through server memory dumps: one permits remote downloads from an exposed endpoint, while the other requires local server access. CISA directed Federal Civilian Executive Branch agencies to apply vendor-supplied mitigations or discontinue use by July 22, 2025.
The warning followed a May disclosure of chat logs and metadata belonging to more than 60 government users, although the reporting did not establish whether either vulnerability enabled that exposure. Separate reporting by Micah Lee challenged TeleMessage’s security marketing, describing the company’s ability to access plaintext chat logs despite its association with Signal. Organizations using TM SGNL should verify that vendor mitigations are applied, assess exposure of memory-dump endpoints, and review whether the service’s archiving and plaintext-access model meets their confidentiality requirements.
