FreeSWITCH Flaw CVE-2026-116779 Under Active Attack

FreeSWITCH, the open-source telecom stack that underpins a large share of the world's VoIP and PBX deployments, has a critical, actively exploited flaw: CVE-2026-116779 (CVSS 9.8). A specially crafted SIP MESSAGE can trick FreeSWITCH into routing attacker-controlled text straight into its own command API, letting an unauthenticated or minimally authenticated sender run arbitrary FreeSWITCH API commands – and, through loaded modules, operating-system commands – with the privileges of the FreeSWITCH process. The practical fix is to upgrade to FreeSWITCH 1.11.3, but upgrading alone does not fully close the hole: the new safeguard that blocks the attack path, enable-chat-api-proto, ships off by default and must be turned on explicitly in every SIP profile. Admins should also check the related CVE-2026-116786 (CVSS 8.8), a SIP REFER call-transfer flaw that is exploitable by any authenticated caller.

What happened

SignalWire, the company that develops and maintains FreeSWITCH, published security advisory GHSA-mg63-h38w-8p9p on October 28, 2026, disclosing a command-injection vulnerability tracked as CVE-2026-116779. The advisory was credited to reporter Orn Arnarson and analyst Gunnlaugur. The National Vulnerability Database (NVD) published its own record for CVE-2026-116779 on November 5, 2026, confirming a CVSS 3.1 base score of 9.8 and the same CWE classifications SignalWire assigned. On November 9, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog under the name "SignalWire FreeSwitch Code Injection Vulnerability," with a remediation due date of November 12, 2026 for federal agencies operating under Binding Operational Directive 26-04.

FreeSWITCH is widely used as the engine behind PBX systems, call centers, conferencing platforms, and SIP trunking gateways, and it is embedded inside many commercial and carrier-grade communications products. A flaw that lets a remote, network-based attacker execute commands with the privileges of the FreeSWITCH process is therefore a serious exposure wherever a FreeSWITCH instance has any SIP signaling reachable from an untrusted network, including the public internet.

How the attack works

According to SignalWire's advisory, the root cause sits in sofia_presence_handle_sip_i_message(), the function that processes inbound SIP MESSAGE requests. That function splits the "To" user portion of the message on a plus sign and treats the text to the left of the plus as the name of a registered chat protocol. FreeSWITCH's bundled mod_dptools module registers a chat protocol literally named "api," and any MESSAGE routed to that protocol is handed to switch_api_execute() – the same internal function that runs commands typed at the FreeSWITCH console or sent over the Event Socket.

In other words, a sender only has to address a SIP MESSAGE so that the protocol selector reads "api," and the body of that message is executed as a FreeSWITCH API command. Because FreeSWITCH's stock configuration loads mod_lua, inline Lua scripting is a second reachable sink from the same entry point, widening the command execution path beyond the built-in API command set. The advisory states plainly that "exploitation of this path has been observed in the wild," and notes that the selector logic does nothing to separate ordinary message-delivery protocols from protocols that trigger command execution.

Two configuration details make this worse in practice. First, inbound chat handling is enabled by default on both the internal and external SIP profiles shipped in FreeSWITCH's stock "vanilla" configuration, and FreeSWITCH's inbound access control lists do not cover SIP MESSAGE traffic the way they cover INVITE. Second, the stock vanilla directory ships a "default" user with no password or a1-hash set, so on installations that have not removed or password-protected that account, a single accepted SIP MESSAGE from any sender is enough – no credentials required.

CVSS score and severity

NVD and SignalWire's advisory agree on a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which resolves to a base score of 9.8 (Critical). That vector reflects a network-exploitable flaw that requires no privileges and no user interaction, with the complete compromise of confidentiality, integrity, and availability once triggered. CISA's own Stakeholder-Specific Vulnerability Categorization (SSVC) scoring for the KEV entry marks exploitation status as "active" and the technical impact as "total."

Why the fix is not fully automatic

Upgrading to FreeSWITCH 1.11.3 is necessary but, on its own, does not shut off the vulnerable behavior. The patch adds a new per-profile configuration parameter, enable-chat-api-proto, which governs whether an inbound SIP MESSAGE is allowed to select the "api" chat protocol at all. Per the advisory, this parameter is off unless an administrator explicitly sets it, and it ships commented out in both the vanilla SIP profile templates and the sample mod_sofia configuration. Requests that get rejected under the new control return a SIP 403 and are logged with the source address and the requested command, which gives defenders a way to watch for probing after the setting is enabled.

SignalWire's advisory is also explicit that none of the narrower workarounds fully close the path by themselves. Setting auth-messages (on by default since FreeSWITCH 1.10.7) forces authentication on SIP MESSAGE, but that is insufficient alone if directory users without passwords remain, and it does nothing to stop an authenticated account from reaching the api-execute path. Setting disable_system_api_commands=true blocks the FreeSWITCH "system" API specifically, but module loading and call origination through other API commands remain reachable. The advisory's recommended combination is to disable inbound chat entirely on profiles that do not need it (enable-chat=false), remove or password-protect any directory user without credentials, and, where SIP chat is required, explicitly set enable-chat-api-proto=false (or leave it at its default-off state while verifying it is actually absent from the active configuration, since the value can be inherited from included profile fragments).

A related flaw: CVE-2026-116786 (SIP REFER)

SignalWire disclosed a second, related issue the same week: CVE-2026-116786 (GHSA-xjxm-9qx6-w3fj), scored 8.8 (High) under CVSS 3.1 with CWE-77 and CWE-94 classifications. Per NVD's description, the function sofia_handle_sip_i_refer() placed raw Refer-To URI parameters and headers from an inbound SIP REFER request directly into a channel-variable block passed to switch_ivr_originate(), the function that places a new call leg. The originate parser treats a comma in that value as a variable separator, so an attacker-controlled Refer-To value could inject an arbitrary channel variable – including execute_on_originate, which runs a dialplan application before the new leg answers. Setting that variable to invoke the "system" application lets an authenticated caller already on a bridged call execute operating-system commands with FreeSWITCH's process privileges.

Unlike CVE-2026-116779, this path requires the caller to hold a registered account and to be on a call that takes an off-box transfer, not anonymous network access or Event Socket access. SIP REFER handling is accepted by default in stock FreeSWITCH configurations, which is why SignalWire flagged it as worth checking alongside the MESSAGE flaw even though its preconditions are narrower. CVE-2026-116786 was fixed in FreeSWITCH 1.11.2; SignalWire's SSVC data for this CVE marks exploitation status as "none" observed so far, in contrast to the active exploitation confirmed for CVE-2026-116779.

Is it in the CISA KEV catalog?

Yes. CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog on November 9, 2026, under the entry "SignalWire FreeSwitch Code Injection Vulnerability," with a required-action due date of November 12, 2026. Under Binding Operational Directive 26-04, federal civilian agencies running affected FreeSWITCH instances must apply vendor mitigations by that date or discontinue use of the product if mitigations cannot be applied, and must follow CISA's forensic-triage guidance given that exploitation is confirmed rather than theoretical. CVE-2026-116786 did not appear in the KEV catalog as of this writing.

This KEV listing is a useful trigger for any organization – not just federal agencies – to treat this as a today problem rather than a backlog item. If this feels familiar, it's the same posture CISA took with other recently KEV-listed bugs covered on this desk, including the Outlook flaw added to the KEV catalog earlier this month.

Who is affected

Any deployment running FreeSWITCH 1.11.2 or earlier with a SIP profile that accepts inbound MESSAGE requests is exposed to CVE-2026-116779, which in stock configurations means both the internal and external profiles out of the box. That includes self-hosted PBX and call-center installations, as well as any commercial product, carrier platform, or managed-communications service built on an unpatched FreeSWITCH core. Because FreeSWITCH is frequently embedded rather than run standalone, organizations should check downstream vendors and appliances for which SIP stack they use, not only their own directly managed servers. Installations that still carry the stock "default" directory user without a password or a1-hash are at the highest risk, since no valid account is needed to reach the vulnerable code path in that case.

Background: SignalWire and FreeSWITCH

FreeSWITCH is a free, open-source "software-defined telecom stack" originally created by developers who went on to found SignalWire, which now maintains the project and offers hosted communications-platform services built on top of it. It has been in production use for roughly two decades as an alternative to proprietary telecom switches, and it is commonly compared with Asterisk in the open-source PBX space. Because it is designed to run on commodity hardware and to be embedded into other products, a core vulnerability tends to propagate into a wide and not always visible installed base. General background on the project is available on Wikipedia's FreeSWITCH entry.

What to do now

Treat this as an active-incident-response item, not a routine patch cycle, given the confirmed in-the-wild exploitation and KEV listing.

• Upgrade to FreeSWITCH 1.11.3 or later. This is the baseline fix for CVE-2026-116779 and also carries forward the 1.11.2 fix for CVE-2026-116786. Check vendor-specific build instructions if you consume FreeSWITCH through a packaged distribution or appliance rather than building from source.
• Explicitly set enable-chat-api-proto=false on every SIP profile after upgrading. The parameter ships commented out and defaults to off for its protective behavior only once set – do not assume the upgrade alone blocks the "api" chat proto selector; verify the directive is actually present and effective in your running configuration, including any included profile fragments.
• Disable inbound chat where it is not needed by setting enable-chat=false on profiles that do not require SIP MESSAGE-based chat at all.
• Audit directory users for missing credentials. Remove or password-protect any account, including the stock "default" user, that lacks a password or a1-hash, and confirm allow-empty-password is not left enabled.
• Do not rely on auth-messages or disable_system_api_commands alone as a substitute for upgrading; SignalWire's advisory describes both as insufficient on their own.
• Review SIP REFER exposure for CVE-2026-116786. If you cannot upgrade immediately, consider whether off-box call transfers via REFER can be restricted at the dialplan or ACL level for lower-trust accounts.
• Check logs for 403 rejections referencing the new chat-api-proto control after enabling it, and for any pre-upgrade log entries showing MESSAGE traffic addressed to an "api" protocol selector, which would indicate prior probing or exploitation attempts.
• Confirm KEV/BOD obligations if you operate as or for a U.S. federal civilian agency, given the November 12, 2026 action due date tied to this listing.

Teams managing a broader patch backlog this month may also want to revisit the November 2026 Patch Tuesday roundup for other critical fixes landing around the same window, and infrastructure teams weighing how aggressively to prioritize non-Microsoft stack bugs like this one can compare notes with the recent OpenSSH flaw affecting Alpine Linux, another infrastructure-level bug that needed prompt attention outside the usual OS patch cadence.

Bottom line

CVE-2026-116779 is a critical, actively exploited command-injection flaw in FreeSWITCH's SIP MESSAGE handling, and it is now on CISA's KEV list with a short remediation clock. Upgrading to FreeSWITCH 1.11.3 is step one, but the advisory is unusually direct that the protective control is opt-in, not automatic: administrators need to explicitly set enable-chat-api-proto (and clean up credential-less directory accounts) to actually close the path that attackers are using today. The lower-severity, authenticated SIP REFER flaw tracked as CVE-2026-116786 is worth checking in the same maintenance window, since the same 1.11.3 upgrade addresses both.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage