FreeSWITCH inbound SIP MESSAGE flaw allows remote code execution via chat API (CVE-2026-116779)

What happened

FreeSWITCH before 1.11.3 mishandles the To user of an inbound SIP MESSAGE. The handler splits that value on a plus sign and treats the left side as a chat protocol selector. When the selector is api, the message reaches switch_api_execute(). A peer whose MESSAGE is accepted can therefore run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges.

The vulnerable path is reachable over the network. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient. In affected configurations, stock directory users without password material can also remove that barrier. The result is configuration and credential disclosure, arbitrary call control, and command execution.

Exploitation is active. CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog, CISA's SSVC assessment lists exploitation as active, and ENISA's EUVD records exploitation since 9 November 2026.

Who is affected

FreeSWITCH deployments before version 1.11.3 are affected. This includes stock internal and external profiles, where inbound chat is enabled. FreeSWITCH is a software-defined telecom stack and often terminates SIP traffic from the internet or from carrier peers; affected organisations should check every profile that accepts SIP MESSAGE requests.

What to do now

1. Upgrade to FreeSWITCH 1.11.3. The maintainers have fixed CVE-2026-116779 in this release.
2. If you cannot upgrade immediately, restrict network access to SIP profiles to trusted peers and review whether inbound chat is required on internal and external profiles.
3. Treat any affected FreeSWITCH instance that was reachable from untrusted networks as potentially compromised until you can review logs for unexpected API or OS command activity.
4. Follow CISA's KEV required action: apply mitigations in accordance with vendor instructions and follow applicable BOD 26-04 guidance. CISA's due date is 12 November 2026.

How to detect it

Review SIP message logs for inbound MESSAGE requests where the To user contains a plus sign and the left-hand side selects the api chat protocol. Look for unexpected FreeSWITCH API command execution, especially commands that launch operating-system processes. Because exploitation is active, treat any such activity on versions before 1.11.3 as suspicious.

Beyond the patch

FreeSWITCH instances are often exposed by design, and this flaw turns an accepted SIP message into command execution without a meaningful authentication step. That makes it more than a patch item: it is a reason to verify telephony infrastructure is visible to security monitoring. Managed Detection & Response (MDR) can watch for the command execution and lateral movement that follow initial access. Virtual CISO Services (vCISO) can help reassess how SIP and other exposed services are managed in your exposure management programme.