CVE-2026-116779: FreeSWITCH SIP MESSAGE runs commands

Call: Patch now. The FreeSWITCH advisory says “exploitation of this path has been observed in the wild.” CISA added CVE-2026-116779 to KEV on November 9 with a due date of November 12. CVSS 9.8, and the default config is exposed.

What breaks: A SIP MESSAGE whose To user looks like api+<something> gets routed to the api chat interface, which hands it to the FreeSWITCH API. The sender picks the command. Per the advisory, that gets you “arbitrary OS commands, disclosure of configuration and credentials, and full call control” as the FreeSWITCH process. If mod_lua is loaded, as it is in the stock config, inline Lua works too.

Who’s hit: FreeSWITCH 1.11.2 and earlier, on any SIP profile that accepts inbound MESSAGE. That’s the default: chat is on unless a profile sets enable-chat=false, and stock conf/vanilla leaves it on for internal and external profiles. The inbound ACL doesn’t cover MESSAGE. Where MESSAGE auth is on, any one registered account is enough. If you still ship conf/vanilla/directory/default/default.xml, its passwordless default user means the attacker doesn’t even need that.

Fix: FreeSWITCH 1.11.3 or later. It adds a per-profile enable-chat-api-proto setting that is off by default, so the route is closed unless you turn it back on. Please don’t turn it back on.

Workaround: Set enable-chat=false on every profile that doesn’t need inbound SIP chat. The advisory is clear that auth-messages alone isn’t enough, and that disable_system_api_commands=true removes the system API but leaves every other API reachable. Delete the passwordless directory users (stock vanilla ships two, default and the Skinny example) either way. Then check for odd API activity, because exploitation came before the KEV listing.

Sources: FreeSWITCH advisory GHSA-mg63-h38w-8p9p (opens in a new tab), CISA KEV (opens in a new tab).

CVE-2026-116779: FreeSWITCH SIP MESSAGE runs commands

Sources

More from November 2026 patch cycle