CVE-2026-116779 SignalWire FreeSwitch Vulnerability Fix

What happened

CVE-2026-116779 is a critical code injection flaw in FreeSWITCH, and it is already being exploited. Versions before 1.11.3 let a SIP peer run FreeSWITCH API commands, including operating-system commands, with the daemon's privileges. The fix is version 1.11.3.

The NVD record was published on 2026-11-05. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on 2026-11-09, with a federal due date of 2026-11-12.

The bug sits in sofia_presence_handle_sip_i_message(). It splits the To user of an inbound SIP MESSAGE on a plus sign and treats the left side as a chat protocol selector. If the selector is api, the request reaches switch_api_execute(). The text after the plus sign then runs as an API command.

Who is affected

Any FreeSWITCH server running a version before 1.11.3 is affected. FreeSWITCH is the software-defined telecom stack published by SignalWire on GitHub. It is often used for VoIP, PBX and call routing.

The NVD record says inbound chat is enabled on the stock internal and external profiles. Any authenticated profile account is enough to trigger the flaw. Stock directory users without password material can also remove that barrier in affected configurations.

That means a default install is a realistic target. Check any vendor appliance or container image that bundles FreeSWITCH, too. Your package or image version decides your exposure.

How serious it is and whether it is exploited

The CVSS 3.1 score is 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The weaknesses are CWE-77, CWE-78 and CWE-749.

The NVD description lists three outcomes:

• Configuration and credential disclosure.

• Arbitrary call control.

• Command execution on the host.

NVD states that exploitation has been observed in the wild, and CISA's KEV listing confirms it. Treat any internet-reachable, unpatched server as a possible compromise, not just a patch ticket.

What to do now

1. Patch to 1.11.3

Upgrade to FreeSWITCH 1.11.3 or later. The release notes and the GitHub security advisory are the vendor references.

The patch pull request adds a per-profile setting, enable-chat-api-proto. It is off unless you set it. A MESSAGE that selects the api proto on a profile without it gets a 403 and is logged with the source and the requested command.

The commit ships the setting commented out in the vanilla profiles. Its comment warns that the setting lets an inbound MESSAGE to api+<command> run API commands, so enable it only for trusted peers. Leave it commented out unless you truly need it.

2. Check your version and exposure

Run these on the FreeSWITCH host:

fs_cli -x 'version'
freeswitch -version
ss -tulpn | grep -i freeswitch

The last command shows which ports and transports FreeSWITCH listens on. Take the SIP ports from that output or from your own SIP profiles. Then confirm from outside your network whether those ports answer.

Next, look for attack traces. The proto compare is case-insensitive, so search without case:

grep -i 'api+' /var/log/freeswitch/freeswitch.log
grep -il 'MESSAGE sip:' /var/log/freeswitch/*.log

Your log path may differ. The 403 response and the logging of the source and requested command exist only from 1.11.3 onward. Older versions may not record these MESSAGE requests at all.

Finding no `api+` hits is not proof of a clean host. An internet-reachable, unpatched server should still be treated as possibly compromised. On 1.11.3 and later, search your logs for the source IP of any blocked attempt.

Then look for files in your directory that have no password parameter:

grep -rL 'name="password"' /etc/freeswitch/directory/

This lists every XML file without a password parameter, including group and other non-user files. Filter the output down to actual user entries before you act on it. Then add real credentials only to those users, not to the other files.

3. If you cannot patch today

The patch is the only fix described in the sources. Until you apply it, cut the exposure by allowing SIP only from peers you trust. Here is a simple example with ufw for one UDP port:

sudo ufw allow from 203.0.113.10 to any port 5060 proto udp
sudo ufw deny 5060/udp

This is only an example. Each profile's ports and transports, both UDP and TCP, must be covered, not just one UDP port. Take the real values from your ss -tulpn output and your SIP profiles. CISA's required action also says to discontinue use of the product if mitigations are unavailable.

Worked example: triaging one server

Say you run a small PBX on an old 1.10.x package. Here is a sensible order of work:

1. Run fs_cli -x 'version'. It shows a version before 1.11.3, so the box is affected.

2. Check whether SIP ports are reachable from the internet. They are, so assume it is a live target.

3. Search logs for api+. Remember that logging of these requests only exists from 1.11.3, so an old version may show nothing even if it was attacked. If you find hits, treat the host as compromised and keep a copy of the logs. If you find none, still treat the exposed host as possibly compromised.

4. Upgrade to 1.11.3 on a rebuilt or verified-clean host where possible.

5. Rotate every credential the config exposed: SIP passwords, gateway logins and API keys.

6. Restrict SIP access to known peers.

The vulnerability permits credential disclosure, so step 5 matters even if you find no signs of command execution. CISA's KEV entry also points to its "Forensics Triage Requirements" guidance. Federal teams must follow it, and other teams can use it as a checklist.

What learners can take from this

This flaw is a clean example of a trust boundary failure. A chat feature let a remote string pick an internal handler, and that handler ran commands. It maps to command injection, insecure defaults and attack surface reduction, which come up often in security exams.

The habit worth building is simple: know which services face the internet, and know their default settings. If you want to practice triage like the steps above, the CompTIA CySA+ CS0-003 exam covers vulnerability management and incident response. Our October 2026 threat roundup shows more active threats.

If you are building Linux admin skills for server work like this, see the CompTIA Linux+ XK0-005 voucher. Vouchers arrive by email within 12 hours.

Sources

• NVD CVE-2026-116779

• FreeSWITCH commit 7015f6a: gate the api chat proto

• FreeSWITCH pull request 3135

• FreeSWITCH v1.11.3 release notes

• GitHub security advisory GHSA-mg63-h38w-8p9p