CriticalCVSS9.82026-11-10
CVE-2026-116779 — FreeSWITCH SIP MESSAGE handling lets attackers run API and OS commands: explainer and fix (fixed in 1.11.3, exploited in the wild, in KEV)
Flaw in SignalWire FreeSWITCH 1.11.2 and earlier (CVSS 9.8). Per the advisory, inbound SIP MESSAGE (chat) handling can be used to run FreeSWITCH API commands, leading to configuration and credential disclosure, call control and OS command execution. The advisory states exploitation has been observed in the wild, and CISA added it to KEV on 9 November (due 12 November). Fixed in 1.11.3. The only measure that fully closes the path is setting enable-chat to false on the relevant profiles. This site's view: do not stop at updating; disable chat where unused, check for compromise and rotate credentials.