FreeSWITCH flaw lets a SIP message run server commands, exploited

On 28 October 2026, SignalWire published an advisory for CVE-2026-116779, a critical flaw in the FreeSWITCH telephony platform. A SIP MESSAGE that a FreeSWITCH profile accepts can make the server run FreeSWITCH API commands, including operating system commands, with the privileges of the FreeSWITCH process. SignalWire says exploitation has been observed in the wild. On 9 November, CISA added the flaw to its Known Exploited Vulnerabilities catalogue.

The bugs

CVE-2026-116779, command execution through inbound SIP chat. It affects FreeSWITCH 1.11.2 and earlier. SignalWire scores it 9.8 (critical).

The flaw is in how FreeSWITCH routes inbound SIP MESSAGE chat. Under certain conditions, an incoming message could reach FreeSWITCH's administrative API instead of the normal chat handling. SignalWire says an attacker who exploits it can:

• run arbitrary OS commands
• read configuration and credentials
• take full control of calls

Where mod_lua is loaded, as it is in the stock configuration, the attacker can also run Lua code.

Default setups are affected. Inbound chat is on unless a profile sets enable-chat=false, and the stock configuration leaves it on for both the internal and external profiles. SignalWire says the inbound ACL does not cover MESSAGE, so tightening the ACL does not protect a profile.

Where message authentication is enforced, any single account on the profile is enough, such as an extension, a handset or a trunk peer. Installations that still have the stock default directory user, which has no password, need no account at all.

The remedy

Updating is the fix. FreeSWITCH 1.11.3 adds a per-profile setting, enable-chat-api-proto, which is off unless you turn it on. That closes this route on every profile by default.

• SignalWire FreeSWITCH: 1.11.3 or later

After updating, confirm the running version is 1.11.3 or later. Do not set enable-chat-api-proto unless you know you need it.

Because the flaw is being exploited, check for compromise as well as updating. Look for unexpected processes, new configuration or modules, and unexpected calls. If anything looks wrong, rotate the credentials stored in your FreeSWITCH configuration.

If you cannot update today

• Set enable-chat=false on every SIP profile that does not need inbound SIP chat. SignalWire says this is the setting that fully closes the route, although it also turns off all inbound chat on that profile.
• Remove every directory user that has neither a password nor an a1-hash. The stock configuration ships two: default and the Skinny example. Combined with message authentication, this means an attacker needs a valid account, but SignalWire says it does not close the route.
• Setting disable_system_api_commands=true is worth doing, but it removes only the system command. Other API commands remain reachable.
• Limit which networks can reach your SIP listeners.

Sources

• SignalWire advisory GHSA-mg63-h38w-8p9p
• CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog