CVE-2026-116779: Remote Command Execution via SIP MESSAGE in FreeSWITCH

Summary

Parameter	Value
CVE ID	CVE-2026-116779
Alert Source	CISA KEV - Active Exploitation
CVE Publication Year	2026
Date Published	2026-11-09
Vendor	SignalWire
Product	FreeSWITCH
CVSS Score	9.8 (critical)
EPSS Score	1.3% (percentile: 71%)
CISA KEV	Yes - confirmed active exploitation
Ransomware	Not confirmed
Remediation Deadline	2026-11-12

Vulnerability Description

Source: NVD, CISA KEV, GitHub Advisory GHSA-mg63-h38w-8p9p

FreeSWITCH is a software-defined telecom stack (softswitch) developed by SignalWire. In versions up to and including 1.11.2, sofia_presence_handle_sip_i_message() splits the To user of an inbound SIP MESSAGE on + and treats the left side as a chat protocol selector. mod_dptools registers an api chat protocol that hands its address to switch_api_execute(). Anyone able to deliver a MESSAGE to a SIP profile can therefore choose which FreeSWITCH API command the server runs — nothing restricts the selector.

The impact is command execution with the privileges of the FreeSWITCH process: arbitrary operating-system commands, disclosure of configuration and credentials, and full call control. Where mod_lua is loaded (as in the stock configuration), inline Lua with the full standard library is reachable as a second sink. Chat handling is enabled by default on the stock internal and external profiles, and the inbound ACL does not cover MESSAGE. Where MESSAGE authentication is enforced, any single account on the profile (extension, handset or trunk) is enough; installations still carrying the passwordless default user from conf/vanilla need no account at all. According to the GitHub Advisory, the flaw has been exploited in the wild; CISA has added it to the KEV catalog.

Required Actions

• Upgrade FreeSWITCH to 1.11.3 or later. The fix adds a per-profile enable-chat-api-proto parameter that is off by default — a MESSAGE selecting the api protocol is answered with 403 and logged. CISA deadline for US federal agencies: 2026-11-12.
• Until upgraded, set enable-chat=false on every SIP profile that does not need inbound SIP chat — this stops the message before the protocol selector is parsed.
• Remove directory users with neither password nor a1-hash (stock conf/vanilla ships default and the Skinny example). auth-messages or disable_system_api_commands=true alone do not close the path — they only reduce it.
• Review FreeSWITCH and system logs for unusual SIP MESSAGE traffic, unexpected API commands and processes spawned by the FreeSWITCH service user; after an incident, rotate SIP and trunk credentials.

Who Is Affected?

The vulnerability affects FreeSWITCH by SignalWire up to version 1.11.2 — standalone VoIP PBXs and gateways, contact center and IVR systems, and platforms built on FreeSWITCH (e.g. FusionPBX). Risk is highest where SIP profiles accept traffic from the internet or from many external subscribers and trunks. If you use a vendor’s VoIP solution, ask whether it is based on FreeSWITCH and when a fix will be delivered.

Sources

• NVD - CVE-2026-116779
• CISA KEV Catalog
• GitHub Advisory - GHSA-mg63-h38w-8p9p
• FreeSWITCH 1.11.3 - release notes
• FIRST EPSS

---

Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.