# FreeSWITCH: exploited SIP message flaw can execute commands Canonical: https://www.oktsec.com/radar/freeswitch-cve-2026-116779 Publisher: Oktsec Language: en Published: 2026-11-11T13:37:53Z Updated: 2026-11-11T13:37:53Z Record reviewed: 2026-11-11T13:37:53Z Latest evidence check: 2026-11-11T13:37:53Z Disclosed: 2026-10-28 SignalWire reports exploitation of a SIP MESSAGE path that can execute commands with FreeSWITCH privileges. Whether credentials are needed depends on message authentication and configured directory accounts. ## Evidence and response priority - Category: Vulnerability - Oktsec priority: Act now - Rationale: The maintainer reports exploitation and CISA lists the CVE. A SIP profile accepting MESSAGE traffic is required; authentication and account configuration affect access. - Evidence: Attacks confirmed - Verification: Vendor confirmed - Fix status: Fix available - Exposure requirement: Application or configuration dependent - Vendor: SignalWire - Products: FreeSWITCH - CVEs: CVE-2026-116779 ## Technical overview An accepted SIP MESSAGE can select an API command handler. Execution uses the FreeSWITCH process privileges. Where message authentication is enforced, a valid account is sufficient; default directory accounts without password material can also expose access. The correction in 1.11.3 disables the API protocol for inbound chat by default. Disabling chat is a temporary mitigation where it is unnecessary. Authentication alone and disabling the system command API do not close every execution route; the inbound ACL does not cover MESSAGE. SignalWire reports exploitation. CISA added the CVE on November 9, after the October 28 advisory. No victim count is established here. ## Recommended response Update FreeSWITCH to 1.11.3 or later. Disable inbound chat on profiles that do not need it and review earlier service activity; an inbound ACL change alone does not close this path. Relevant to: Operators of FreeSWITCH SIP profiles that accept inbound MESSAGE traffic. ## CVE attribution - CVE-2026-116779: SignalWire — FreeSWITCH. [Source](https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p) ## Affected systems and fixes ### FreeSWITCH Affected: 1.11.2 and earlier, with an inbound SIP MESSAGE accepted by a profile. Fixed release / action: 1.11.3 or later Confirm the running version against the vendor advisory, including any distribution backports. ## CISA KEV evidence Catalog: 2026.11.10 Checked: 2026-11-11T13:38:13.699Z ### [CVE-2026-116779](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-116779) - Added: 2026-11-09 - Ransomware use: Not confirmed by CISA - Federal due date: 2026-11-12 - Federal forensic triage: Yes Action specified by CISA: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. CISA KEV inclusion establishes known exploitation of the listed CVE, not compromise of your environment. Absence does not rule out exploitation. The date added is not the first attack date. Federal deadlines and forensic triage requirements are context, not universal obligations for private organizations or businesses in Latin America. ## Supporting evidence Snapshot checked: 2026-11-11T13:38:14.304Z. These dates do not change the incident’s editorial review date. ### FIRST EPSS forecast - [CVE-2026-116779](https://api.first.org/data/v1/epss?cve=CVE-2026-116779): 2.18% probability of observed exploitation in the next 30 days; percentile 82.48%; score date 2026-11-10. EPSS is a prediction, not exploitation evidence or organization-specific risk. Confirmed exploitation takes precedence. A missing score is not zero. Check status: available; last successful check: 2026-11-11T13:38:14.304Z. ## Response checklist 1. **Identify reachable SIP profiles** — Record version, inbound MESSAGE handling and message authentication. Include directory users without password or hash values. 2. **Update and check service configuration** — Install 1.11.3 or later. Leave enable-chat-api-proto disabled unless explicitly required and reviewed. Disable chat on profiles that do not need inbound messages. 3. **Review activity before the fix** — Oktsec recommends preserving service logs and investigating unexpected commands, modules, calls and outbound connections. Recover affected credentials and hosts separately from installing the patch. ## Relevance to AI environments Oktsec recommends including voice services used by agents and automation in the inventory; the flaw is in the telephony service. ## Sources - [SignalWire: security advisory](https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p) — SignalWire; Vendor notice; checked 2026-11-11T13:37:53Z - [CISA KEV: exact CVE records](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json) — CISA; Government advisory; checked 2026-11-11T13:37:53Z ## Editorial record - 2026-11-11T13:37:53Z: Added affected configurations, vendor corrections and confirmed exploitation evidence. ## Use this advisory in Radar Use the Advisory view to understand the issue and its evidence, Affected systems to compare versions, and Response plan to record applicability, an owner and action progress. Plans are saved only in the current browser and can be downloaded for sharing; they are not a shared team account or an automated scan. Completing a plan does not validate remediation. Talk to Oktsec opens a technical consultation with the advisory and selected service preserved. Scope, fees and access are agreed before any assessment. [Open advisory](https://www.oktsec.com/radar/freeswitch-cve-2026-116779) · [Build a response plan](https://www.oktsec.com/radar/freeswitch-cve-2026-116779#review-workspace) - [Exposure check consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=freeswitch-cve-2026-116779&service=exposure_check) - [Patch verification consultation](https://www.oktsec.com/contact?source=radar&intent=assessment&item=freeswitch-cve-2026-116779&service=patch_verification) ## Scope and corrections Radar is a selected editorial collection, not a complete vulnerability database or a scan of your environment. Priorities are Oktsec analysis. Source confirmation and checklist completion do not establish whether your systems are compromised or secure. [Sources and methodology](https://www.oktsec.com/radar/about). Report corrections with supporting sources to info@oktsec.com. Do not send secrets or private incident data.