On November 9, the US Cybersecurity and Infrastructure Security Agency (CISA) added the FreeSWITCH flaw CVE-2026-116779 to its Known Exploited Vulnerabilities (KEV) catalog. With a single crafted SIP message, attackers can run arbitrary FreeSWITCH API commands on vulnerable systems – up to operating system commands with the privileges of the FreeSWITCH process. All versions up to and including 1.11.2 are affected; the fix ships in version 1.11.3. Anyone running the open-source telephony software should install the update now or at least switch off inbound chat.
CVE-2026-116779: what is behind the flaw
FreeSWITCH is a widely used open-source softswitch that powers many VoIP phone systems, call center platforms and conferencing services. The project is maintained by SignalWire. According to security advisory GHSA-mg63-h38w-8p9p, the bug sits in the function sofia_presence_handle_sip_i_message(), which handles inbound SIP MESSAGE requests – text messages sent over the SIP protocol.
The function splits the recipient (“To” user) of such a message on the plus sign and treats the left half as the name of a chat protocol. The message is then dispatched to whichever registered chat interface matches. The problem: the mod_dptools module registers a chat interface called api that hands its address straight to switch_api_execute(). Anyone able to deliver a SIP message therefore chooses which FreeSWITCH API command the server runs. Nothing restricted the selector, and message-delivery protocols were not distinguished from command-execution protocols.
The advisory describes the impact as follows: execution of arbitrary OS commands, disclosure of configuration and credentials, and full call control. Where mod_lua is loaded – as it is in the stock configuration – inline Lua with the full standard library is reachable as a second sink. And: “Exploitation of this path has been observed in the wild.”
Scoring and classification
- CVSS 3.1: 9.8 (critical) – network attack, low complexity, no privileges and no user interaction required.
- Weakness types: CWE-77 (command injection), CWE-78 (OS command injection) and CWE-749 (exposed dangerous method or function).
- Affected: FreeSWITCH up to and including 1.11.2.
- Fixed: in version 1.11.3 and later.
- Credited: Örn Arnarson and Gunnlaugur.
The CVE record has been public in the NVD since November 5. In its SSVC assessment, CISA rated it “exploitation: active,” “automatable: yes” and “technical impact: total.”
Why the default configuration is exposed
What makes this especially tricky is that, according to the advisory, no unusual setting is needed for an attack. Any SIP profile that accepts inbound MESSAGE requests is affected. Chat handling is on by default unless a profile sets enable-chat=false, and the bundled sample configuration conf/vanilla leaves it enabled on both the internal and external profiles. The inbound ACL does not cover MESSAGE requests – so tightening the ACL does not take a profile out of scope.
The only prerequisite is getting a single SIP message accepted by a profile. Where message authentication is enforced, any account on that profile is enough: an extension, a handset or a trunk peer that is merely allowed to register. It gets even easier on installations that still carry the file conf/vanilla/directory/default/default.xml. It defines a user called default with no password and no A1 hash – and such a user authenticates successfully unless allow-empty-password is set to false for it. That likely explains why the advisory scores the flaw as requiring no privileges.
Patch and workarounds
Version 1.11.3 introduces a new per-profile parameter, enable-chat-api-proto. It controls whether an inbound message may select the api chat protocol and is off by default, so the route is closed on every profile unless someone explicitly enables it. If a message tries to select the protocol anyway, FreeSWITCH answers with a 403 and logs the source and the requested command. According to the 1.11.3 release notes, the option was added to both mod_sofia and mod_verto, and the To-user split in the inbound message handler is now bounded. On GitHub, the release is dated August 28, 2026, and the advisory October 28 – so the patch was available before disclosure.
For those who cannot update right away, the advisory lists only one effective workaround:
enable-chat=falseon every profile that does not need inbound SIP chat. This stops the message before the protocol selector is parsed – but also disables all inbound chat delivery on that profile.auth-messagesalone is not enough. Message authentication has been enabled by default since version 1.10.7. Combined with removing every directory user that has no password or A1 hash –conf/vanillaships two,defaultand the Skinny example – it reduces the issue to command execution by authenticated users, but does not close the path.disable_system_api_commands=trueremoves thesystemAPI but not the route itself. Every other registered API, including module loading and call origination, remains reachable. The advisory says it is worth setting, but it is not a fix.
Because the flaw is already being exploited, it is also wise – as a general precaution rather than a requirement from the advisory – to look for signs of compromise: unusual SIP MESSAGE requests with a plus sign in the recipient, unexpected processes running as the FreeSWITCH user, modified configuration files and suspicious calls, such as expensive international connections. Credentials stored in the configuration, for example for SIP trunks, should be rotated if compromise is suspected. Neither SignalWire nor CISA has published concrete indicators of compromise in the sources we reviewed.
CISA deadline and the rest of the KEV batch
According to CISA’s alert of November 9, four flaws were added to the catalog at once: besides CVE-2026-116779, an authentication flaw in GPUStack (CVE-2026-102895), an authorization flaw in IBM Aspera Faspex (CVE-2026-123218) and the OpenSSH flaw CVE-2026-123158, which we covered as the SSHole login bypass in OpenSSH 10.6p2. US federal agencies must remediate all four by November 12 – under directive BOD 26-04, including a forensic check of whether systems were compromised before the patch. Whether the FreeSWITCH flaw is used in ransomware campaigns is listed as unknown by CISA.
Our take
In many organizations, telephony servers are infrastructure that gets set up once and rarely touched again. That is exactly what makes them attractive targets: they are often directly reachable from the internet, hold credentials for SIP trunks and can run up high costs quickly when abused. The FreeSWITCH flaw also follows a familiar pattern: a convenience feature in the default configuration becomes an entry point because input is passed unchecked to a powerful interface.
A similar case was the recently exploited Barracuda ESG flaw CVE-2026-116606, where an edge device could likewise be taken over without logging in. And as with the WordPress updater added to CISA KEV, once a flaw lands in the KEV catalog, it is no longer a theoretical risk. Who is attacking FreeSWITCH systems, and how many installations are affected, remains unknown. For operators, that changes little: update to 1.11.3, disable inbound chat where it is not needed, and remove passwordless sample users.
