FreeSWITCH Vulnerability CVE-2026-116779 Exploited in the Wild to Run Commands
Do Son 
TL;DR
Attackers have exploited CVE-2026-116779, a critical FreeSWITCH vulnerability that lets a single SIP message run server commands. The flaw scores 9.8 on CVSS v3.1. SignalWire’s FreeSWITCH team disclosed it on October 28 alongside two more critical bugs. The advisory states plainly: “Exploitation of this path has been observed in the wild.”
A crafted SIP MESSAGE can reach FreeSWITCH’s API and execute commands with the server’s privileges. Two other flaws, both rated 9.1, affect WebSocket handling and WebRTC call security. Upgrade to FreeSWITCH 1.11.3 and set the new security options, since some fixes ship turned off.
- Vulnerabilities: 3 flaws (CVE-2026-116779, CVE-2026-116785, CVE-2026-116790)
- Highest severity: 9.8 (Critical · CVSSv3)
- Status: 1 exploited
- Action: See vendor advisories
| CVE | CVSS (CVSSv3) | Status |
|---|---|---|
| CVE-2026-116779 | 9.8 | Exploited in the wild |
| CVE-2026-116785 | 9.1 | Not exploited |
| CVE-2026-116790 | 9.1 | Not exploited |
Why It Matters
FreeSWITCH is an open-source telephony platform used to build PBX, call center and WebRTC services. A compromise can expose call control, credentials and the underlying server. According to the advisory, successful attacks give “arbitrary OS commands, disclosure of configuration and credentials, and full call control.”
Worse, the exploited bug works in the default setup. Chat handling stays on unless a profile disables it. The stock configuration leaves it on for both internal and external profiles.
How the Attack Works
CVE-2026-116779: SIP MESSAGE command execution (CVSS 9.8)
FreeSWITCH reads part of an inbound SIP MESSAGE’s recipient field as a chat protocol name. One registered handler, called “api,” passes its input straight to the FreeSWITCH API. As the advisory explains, “a peer that can deliver a MESSAGE to a profile therefore selects which FreeSWITCH API command the server runs.”
Where MESSAGE authentication is on, any single account on the profile is enough. However, older sample configurations include a directory user with no password. In that case, an attacker “need[s] no account of their own.” When mod_lua is loaded, as in the stock setup, inline Lua code becomes a second route to run commands.
CVE-2026-116785: WebSocket heap overflow (CVSS 9.1)
The second FreeSWITCH vulnerability sits in mod_xml_rpc’s WebSocket handler. A crafted frame length turns negative and triggers “an unbounded write of client-supplied bytes” past a 64 KiB buffer. No login is needed, even when HTTP authentication is set. So far, the advisory says “remote code execution has not been demonstrated.” Both the module and its WebSocket endpoint are off by default.
CVE-2026-116790: Forged ICE checks (CVSS 9.1)
FreeSWITCH signs the STUN checks it sends but never verifies the ones it receives. Consequently, a forged packet sent to a call’s media port can redirect the call’s audio. Where calls skip media encryption, this allows eavesdropping and injection. Any WebRTC or ICE-enabled call is exposed without extra settings.
Affected Versions
- CVE-2026-116779: FreeSWITCH 1.11.2 and earlier, fixed in 1.11.3
- CVE-2026-116785 and CVE-2026-116790: FreeSWITCH 1.11.1 and earlier, fixed in 1.11.2
Patch and Mitigation
Upgrade to FreeSWITCH 1.11.3, which includes all three fixes. Note that FreeSWITCH tagged 1.11.2 on August 9 and 1.11.3 on August 28, well before the advisories went public. Then check these settings:
- Leave the new enable-chat-api-proto option off, which is the default.
- Set the ice_verify_message_integrity channel variable. The ICE check fix is “opt-in and off by default.”
- Set enable-chat=false on profiles that do not need SIP chat.
- Remove directory users that have no password or hash.
- Leave enable-websocket unset in mod_xml_rpc, or firewall its port.
The FreeSWITCH vulnerability under attack is not yet in CISA’s KEV catalog. Admins should also review logs for unexpected SIP MESSAGE traffic and API activity.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
