FreeSWITCH Flaw CVE-2026-116779 Is Being Exploited to Run Commands With One SIP Message: Update to 1.11.3

TL;DR: SignalWire, which maintains the open-source FreeSWITCH telephony platform, says attackers are exploiting CVE-2026-116779, a Critical flaw (CVSS 9.8) that lets one SIP MESSAGE request run FreeSWITCH API commands, including operating system commands. It affects FreeSWITCH 1.11.2 and earlier and is fixed in 1.11.3. The same batch of advisories fixes two more Critical flaws, CVE-2026-116785 and CVE-2026-116790, one of which needs a setting turned on after you upgrade.

What happened

The flaw: SignalWire published advisory GHSA-mg63-h38w-8p9p on October 28, 2026. When FreeSWITCH receives a SIP MESSAGE (a chat message sent over the phone network protocol), it reads part of the recipient name as the name of a chat handler. One built-in handler, called api, passes its input straight to the FreeSWITCH API. So anyone who can get a single MESSAGE accepted can choose which command the server runs, with the FreeSWITCH process’s privileges. SignalWire says that can mean arbitrary operating system commands, exposure of configuration and credentials, and full control of calls.

Who is affected: FreeSWITCH 1.11.2 and earlier, on any SIP profile that accepts inbound MESSAGE requests. SignalWire says that’s the default: chat is on unless a profile sets enable-chat=false, and no other setting is needed. Where MESSAGE authentication is on, any one account on the profile is enough, such as a desk phone or a trunk. Systems that still carry the sample directory user called default, which has no password, don’t need an account at all.

The fix: FreeSWITCH 1.11.3. It adds a per-profile enable-chat-api-proto setting that is off unless you turn it on. A MESSAGE that tries the api route is then refused with 403 and logged with its source and the command it asked for. FreeSWITCH 1.11.3 was published on GitHub on August 28, 2026, two months before the advisory, so systems that already updated have the fix. No separate 1.10.x fix is listed.

Exploitation: SignalWire’s advisory says: “Exploitation of this path has been observed in the wild.” It doesn’t say who was attacked. CVE-2026-116779 wasn’t in CISA’s catalog of exploited flaws (version 2026.10.28) at our check, and the CVE record wasn’t yet published on cve.org.

The rest of the batch: SignalWire published 21 FreeSWITCH advisories on October 26 and 28. Besides CVE-2026-116779, the most serious are:

• CVE-2026-116785 (Critical, 9.1): a heap overflow in the WebSocket endpoint of mod_xml_rpc that needs no login. The module and its WebSocket endpoint are both off in a default install. Fixed in 1.11.2.
• CVE-2026-116790 (Critical, 9.1): FreeSWITCH accepts ICE connectivity checks without verifying their STUN MESSAGE-INTEGRITY, so an attacker who can reach the media port of a WebRTC or other ICE call can redirect its audio and, on unencrypted calls, listen in. The check arrived in 1.11.2 but is off by default; you have to set the ice_verify_message_integrity channel variable.
• CVE-2026-116786 (High, 8.8): a registered user can inject settings through a SIP REFER (call transfer) request and run operating system commands. Fixed in 1.11.2.

Why it matters

FreeSWITCH sits underneath many business phone systems, call centers and WebRTC voice services, including setups that small businesses buy from a local provider without knowing the engine inside. SignalWire says a hijacked server can expose its configuration and credentials and give attackers full call control. Our read: that means attackers could reach call recordings stored on the server and could use it to place expensive fraudulent calls on your account. The exploited route is on by default, one desk phone’s account is enough, and SignalWire notes that FreeSWITCH’s inbound access list doesn’t cover MESSAGE requests, so tightening it doesn’t help. Our Security hub tracks other patches worth doing now, including today’s exploited Cisco ASA and FTD flaw.

What to do now

1. Find out if you run FreeSWITCH. If your phone system is hosted or managed, ask the provider which version it runs and when it will be on 1.11.3.
2. Upgrade to 1.11.3. Then set ice_verify_message_integrity, leave enable-chat-api-proto off, and remove directory users that have no password.
3. If you can’t upgrade today, set enable-chat=false on every SIP profile that doesn’t need SIP chat. That’s SignalWire’s workaround for the exploited flaw.
4. Check for signs of attack. Our advice is to look for inbound MESSAGE requests to api+ addresses, unexpected outbound calls, and accounts or configuration changes you didn’t make.

Updates

• Oct 29, 2026, 1:50 p.m. Manila: First published.

Sources & method

Sources

• SignalWire FreeSWITCH advisory GHSA-mg63-h38w-8p9p, CVE-2026-116779 (Oct 28, 2026)
• SignalWire FreeSWITCH advisory GHSA-jj89-q47c-gh94, CVE-2026-116785 (Oct 28, 2026)
• SignalWire FreeSWITCH advisory GHSA-rc25-33hp-6mv2, CVE-2026-116790 (Oct 28, 2026)
• SignalWire FreeSWITCH advisory GHSA-xjxm-9qx6-w3fj, CVE-2026-116786 (Oct 28, 2026)
• FreeSWITCH security advisories list
• FreeSWITCH v1.11.3 release (Aug 28, 2026)
• CISA Known Exploited Vulnerabilities catalog (version 2026.10.28)

Method. Checked October 29, 2026, at 1:00 p.m. Manila time (05:00 UTC). The affected and fixed versions, scores, workarounds and the exploitation statement come from SignalWire’s advisories on GitHub; the advisory count and dates come from the repository’s advisory list, and the release date from its GitHub release. We checked the KEV catalog (version 2026.10.28) and cve.org for CVE-2026-116779. Steps labelled “our advice” are our own judgment, not SignalWire’s. The thumbnail is the preview image of SignalWire’s FreeSWITCH page. No affiliate links on this page. How we work.