An explainer for a vulnerability in FreeSWITCH (open-source software used in IP telephony switches and contact-centre call platforms) that lets SIP MESSAGE handling run administrative commands. It is written for people who operate IP telephony, contact centres and call infrastructure, and covers impact and response from the defender's side without attack steps.
- CVE
- CVE-2026-116779 (GitHub advisory GHSA-mg63-h38w-8p9p)
- Severity
- CVSS v3.1 9.8 (Critical; vector AV:N/AC:L/PR:N/UI:N; assigned by GitHub)
- Type
- Command injection (CWE-77, CWE-78); exposed dangerous method (CWE-749)
- Preconditions
- Advisory: being able to send a SIP MESSAGE the profile accepts. CVE record: any authenticated account is sufficient (some configurations remove the authentication barrier)
- Affected
- SignalWire FreeSWITCH 1.11.2 and earlier
- Fix
- FreeSWITCH 1.11.3 or later (the new setting is off by default)
- Dates
- Advisory: 28 October 2026 / CVE record: 5 November 2026
- Exploitation
- The advisory states observed in the wild. Added to CISA KEV on 9 November (due 12 November)
Risk of waiting
FreeSWITCH runs as a daemon, and per the advisory OS commands run with its privileges. Its configuration often holds SIP account, trunk and management-connection credentials, so a leak reaches beyond the telephony platform. Calls can also be controlled; in this site's assessment, that could lead to charges from fraudulent outbound calls.
What the vulnerability is
Per the advisory, FreeSWITCH's handling of inbound SIP MESSAGE (text messages) chose a chat type from how the message was addressed. Selecting one of those types ran FreeSWITCH's administrative API, so API commands, including ones that run OS commands, execute with the daemon's privileges. This site does not describe the shape of the message or how the selection is made.
The advisory says inbound chat is enabled on the stock internal and external profiles. In other words, you can be affected without any special configuration.
Before (1.11.2 and earlier)
- An accepted SIP MESSAGE can reach the administrative API
- Inbound chat is on in the stock profiles
- Having an authenticated account is enough to run it
Changes in 1.11.3 and later
- Selecting the API becomes a per-profile setting (enable-chat-api-proto)
- That setting is off unless set explicitly
- Profiles that do not need chat can stop receiving it with enable-chat
Who is affected
| Item | Detail |
|---|---|
| Product | SignalWire FreeSWITCH |
| Affected versions | 1.11.2 and earlier (CVE record wording: before 1.11.3) |
| Fixed version | 1.11.3 or later |
| Fully closes the path | enable-chat set to false on the relevant profile |
| Mitigation only | MESSAGE authentication (auth-messages, on by default since 1.10.7); removing directory users without a password |
| Does not close it | disable_system_api_commands set to true (removes only the system API) |
- A directory user with no password (the advisory cites the default user in the conf/vanilla directory as an example) removes the authentication barrier. Authentication is not enforced for that user unless allow-empty-password is set to false.
- IP-PBX and call-platform products that embed FreeSWITCH may ship the fix under their own version numbers. Ask your provider.
How to check whether you are affected
Check your FreeSWITCH version
Check the running version (for example with the version command in fs_cli) or the version of the package or container. 1.11.2 or earlier is affected. If you have several switches (production, staging, development, one per site), check each one (asset inventory checklist).
Check whether SIP listeners are exposed
Check whether the Sofia profiles (internal, external and others) can be reached from the internet or any other untrusted network. Include ports opened for trunks and remote workers' endpoints.
Check the chat settings
Look at enable-chat and auth-messages on each profile. The advisory says inbound chat is on in the stock internal and external profiles. Also note which profiles actually use chat.
What to do today
Update to 1.11.3 or later (top priority)
Update FreeSWITCH to 1.11.3 or later. The KEV due date is 12 November. If it is embedded in a product, apply your provider's fixed release.
Set enable-chat to false on profiles that do not use chat
The advisory lists enable-chat set to false on every profile that does not need inbound SIP chat as the only measure that fully closes the path. Make this the top interim measure until you can update, and keep unused profiles disabled afterwards.
Strengthen authentication and narrow reach (mitigation)
Enable auth-messages and remove directory users that have no password or a1-hash. As this site's own addition, limit the source addresses that can reach the SIP listeners to your trunks and the endpoints that need them. These only reduce who can attack; they do not close the path.
Check whether you have already been compromised
Because exploitation has been observed, for the period before the update look for unexpected inbound SIP MESSAGEs, unexpected outbound calls or a spike in call charges, and unexpected processes or changes to configuration files. KEV marks this entry for forensic triage. The vulnerability remediation playbook covers the process.
Rotate credentials if in doubt
The advisory says configuration and credentials can be disclosed. If you find suspicious signs, rotate SIP account passwords, trunk credentials and management-connection passwords, and talk to your carrier.
Exploitation status
- The advisory and the CVE record both state that exploitation of this path has been observed in the wild.
- CISA added it to KEV on 9 November 2026 with a due date of 12 November (KEV catalogue version 2026.11.09).
- KEV records ransomware use as Unknown and forensic triage as Yes.
- CISA's assessment (exploitation active, automatable, total technical impact) has been added to the CVE record.
- NVD's status is Analyzed.
- Public information on scale, actors or the number of victims could not be confirmed.
This site's view: prefer the setting that stops receipt over mitigations
Reasoning "we require authentication, so we are fine" is risky, for two reasons.
First, the advisory states that authentication is only a mitigation, and one stolen authenticated account gives the same result. Second, many switches do not use chat at all, and for those, setting enable-chat to false costs nothing in operations. A change with no business impact that closes the path itself should come first, together with the update (prioritising with CVSS, EPSS and KEV).
Sources
- SignalWire FreeSWITCH — GHSA-mg63-h38w-8p9p: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands (published 28 October 2026; affected and fixed versions, mitigations, observed exploitation)
- CVE.org — CVE-2026-116779 (published 5 November 2026; before 1.11.3; CVSS 9.8; includes CISA's addition)
- NVD — CVE-2026-116779 (Analyzed; CWE-77, CWE-78, CWE-749)
- CISA KEV — Known Exploited Vulnerabilities Catalog (added 9 November, due 12 November)
Last verified: 10 November 2026.