In FreeSWITCH 1.11.2 and earlier, an inbound SIP MESSAGE can select the api chat proto exposed by mod_dptools and run FreeSWITCH API commands, leading to OS command execution with FreeSWITCH privileges, disclosure of configuration and credentials, and full call control [1]. SignalWire says exploitation of this path has been observed in the wild, and CISA added CVE-2026-116779 to KEV on Nov 9 [1][2]. Upgrade to FreeSWITCH 1.11.3 or later; otherwise set enable-chat=false on every profile that does not need inbound SIP chat [1].
A crafted SIP MESSAGE lets attackers run commands on FreeSWITCH; CVE-2026-116779 exploited and added to KEV
1 min read
- Disclosed
- Oct 29, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 10, 2026
- CVSS basis
- Our assessment
- 2.5%, higher than 85% of CVEs
- Exploitation and patch status
- ExploitedKEVPatch available
- Technology
- Attack vector
- Vulnerability status
- Actor type
On this page
30-second summary
What happened
Who is affected
Organisations running: SignalWire FreeSWITCH
What to do nowOur advice
Upgrade to FreeSWITCH 1.11.3 or later; otherwise set enable-chat=false on every profile that does not need inbound SIP chat [1]
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| SignalWire FreeSWITCH | <= 1.11.2[1] | 1.11.3 | ✓ Patched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
Technical details
Remediation
Vendor guidance
- 1Upgrade to FreeSWITCH 1.11.3 or later patch[1]
The new version disables enable-chat-api-proto by default, closing the path.
- 2Set enable-chat=false on profiles that do not need SIP chat mitigate[1]
This stops the message before the proto selector is parsed; also remove directory users without passwords.
References
Official / primary2
- [1]
“Command execution with the privileges of the FreeSWITCH process: arbitrary OS commands, disclosure of configuration and credentials, and full call control.”
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.