Signal RingRTC CVE-2026-113380 Vulnerable Devices with Signal Activity
Identifies devices with Signal software flagged by Defender Vulnerability Management for CVE-2026-113380 (RingRTC before 2.72.0, hangup commands dropped when call state machine queue is flooded). Exposure rule, not an exploit detection; results are deduplicated per device and sorted by recent Signal activity.
Microsoft Sentinel (KQL)

