SignalWire’s FreeSWITCH team has disclosed three critical vulnerabilities in the open-source telephony platform, including CVE-2026-116779, a CVSS 9.8 command execution flaw reachable through a crafted SIP MESSAGE. The advisory states that exploitation of that bug “has been observed in the wild,” and the project shipped fixes in FreeSWITCH 1.11.3 on the day of disclosure.
How a Crafted SIP MESSAGE Reaches the FreeSWITCH API
In CVE-2026-116779, part of the recipient field in a SIP MESSAGE is read as the name of a chat protocol. If that name is “api,” the handler passes the input to the FreeSWITCH API, which runs commands with the privileges of the server process. Chat handling is switched on by default for both the internal and external profiles.
Per the advisory, the consequences are arbitrary operating system commands, disclosure of configuration data and credentials, and full control of calls handled by the server.
Authentication Requirements and Passwordless Sample Users
Where MESSAGE authentication is enabled, an attacker needs one valid account. The advisory notes, however, that older sample configurations include a directory user with no password, which removes the need for an account in deployments that still use those defaults. Where the mod_lua module is loaded, as it is by default, inline Lua provides a second route to execution.
The Two Other Critical Flaws in FreeSWITCH
The other two critical bugs are rated 9.1 and affect WebSocket handling and WebRTC call security. The WebSocket issue sits in the mod_xml_rpc handler: a crafted frame length becomes negative, producing an unbounded write past a 64 KiB buffer. The advisory says no login is required even when HTTP authentication is enabled, and that remote code execution has not been demonstrated for this flaw. Public detail on the WebRTC call-security flaw is limited to its rating and affected area.
Fixed Release 1.11.3 and the New Security Options
Fixes arrive in FreeSWITCH 1.11.3, and the project recommends upgrading while enabling the new security options. Some of the fixes ship turned off, so installing the release does not by itself close every path. Administrators have to switch the relevant settings on after upgrading.
The advisory does not state how widespread the exploitation is, who is carrying it out or what attackers have done with access. Affected software includes open-source PBX systems, call-center platforms and WebRTC deployments that use versions before 1.11.3.
Why Default-On Chat Handling Widens the FreeSWITCH Attack Surface
The structure of CVE-2026-116779 shows how a feature intended for messaging can become a command channel. SIP is designed to accept messages from outside the server, and FreeSWITCH enabling chat handling for the external profile by default means the vulnerable code path faces untrusted senders as a matter of course. The passwordless sample user compounds this: configuration files copied from older documentation can carry the risk forward for years.
Telephony servers hold value beyond a remote shell. Call control and stored credentials are the kind of access that could support fraud or interception, although the advisory does not say either has occurred here. The advisory does confirm that exploitation was already being observed by the time the fix was published.
The “fixes shipped turned off” detail is the part most likely to leave systems exposed in practice. An administrator who runs a routine package upgrade and does not read the release notes could end up on 1.11.3 without the protections active. Operators of FreeSWITCH servers face a two-step job: upgrade, then confirm each new security option is enabled for their own deployment.
Operators who cannot upgrade immediately have no stated workaround in the advisory. The 9.8-rated flaw is reachable through the SIP service that a telephony server exists to expose, which leaves little room to block the path without disrupting normal calls. The project’s guidance therefore centers on the upgrade itself, and on checking that the older passwordless sample directory user is removed from any configuration inherited from earlier installs.
