FreeSWITCH Fixes Actively Exploited SIP MESSAGE Command Execution Flaw

FreeSWITCH 1.11.2 and earlier are affected by an actively exploited SIP MESSAGE command-execution flaw. Upgrade to 1.11.3 or later; other advisory settings are not complete fixes.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

A blue communications server and audio waveform sit inside a glowing shield as a red message envelope is stopped at the boundary in a dark server room.
Original AI-generated editorial illustration of defensive protection around a voice communications server; not official SignalWire or FreeSWITCH artwork.

FreeSWITCH Fixes Actively Exploited SIP MESSAGE Command Execution Flaw1

SignalWire says attackers have exploited a FreeSWITCH command-execution path in the wild.1 CVE-2026-116779 affects FreeSWITCH 1.11.2 and earlier.1 FreeSWITCH 1.11.3 and later contain the fix.1

ACTIVELY EXPLOITED • Reporting cutoff: October 29, 2026, 6:45 a.m. EDT / 10:45 UTC1

The bottom line

Administrators responsible for affected FreeSWITCH deployments should upgrade to version 1.11.3 or later.1 Until the upgrade is complete, set enable-chat=false on every SIP profile that does not require inbound chat.1

Verified facts

AffectedFreeSWITCH 1.11.2 and earlier.1
FixedFreeSWITCH 1.11.3 and later.1
SeverityCritical, CVSS v3.1 9.8.1

Who is exposed

An affected FreeSWITCH release must run a SIP profile that accepts inbound SIP MESSAGE traffic to meet the advisory’s exposure condition.1 SignalWire says chat handling is enabled unless a profile sets enable-chat=false.1 The stock vanilla configuration leaves chat enabled for internal and external profiles.1

An accepted inbound SIP MESSAGE can select the api chat interface and execute FreeSWITCH API commands with the service process’s privileges.1 SignalWire lists possible impact as operating-system command execution, configuration and credential disclosure, and call control.1

What defenders should do

  1. Upgrade to FreeSWITCH 1.11.3 or later.1
  2. Use the bounded interim control only where inbound chat is not required: set enable-chat=false on each such SIP profile.1
  3. Do not treat the other advisory settings as complete fixes.1 MESSAGE authentication alone does not close the path.1 Tightening the inbound ACL does not take a profile out of scope.1 Setting disable_system_api_commands=true removes the system API but leaves the route to other registered APIs.1

Why the release matters

The v1.11.3 release added a gate for the API chat protocol.2 The project strongly encourages users to upgrade to v1.11.3.2

What remains unknown

SignalWire says exploitation of this path has been observed in the wild.1 In the frozen advisory reviewed at the reporting cutoff, no threat actor, victim count, campaign geography, first exploitation date, or campaign-specific indicator was identified.1

Sources

  1. SignalWire FreeSWITCH advisory GHSA-mg63-h38w-8p9p — published October 28, 2026.
  2. FreeSWITCH v1.11.3 release — published August 28, 2026.

Reporting note: Source status was checked through October 29, 2026, 6:45 a.m. EDT.12 This article does not include exploit payloads or reproduction steps.

Browse Articles

Latest Articles