FreeSWITCH flaw exploited to run commands on servers

Attackers have exploited CVE-2026-116779, a critical flaw in FreeSWITCH that allows a single crafted SIP MESSAGE to execute commands on the server. The vulnerability scores 9.8 on CVSS v3.1 and, according to SignalWire’s FreeSWITCH team, exploitation has been observed in the wild.

The bug arises because FreeSWITCH reads part of an inbound SIP MESSAGE’s recipient field as a chat protocol name; a registered handler called “api” then passes input directly to the FreeSWITCH API, enabling arbitrary operating-system commands with the server’s privileges. In some common stock configurations, a directory user with no password can enable exploitation without a valid account, and if mod_lua is loaded, inline Lua code provides an additional route to run commands. The advisory notes the default setup can permit chat handling to remain enabled unless explicitly disabled.

CVE-2026-116779 is the primary exploited flaw; CVE-2026-116785 (WebSocket heap overflow) and CVE-2026-116790 (Forged ICE checks) are rated 9.1 and not reported as exploited in the wild at this time. The affected versions are FreeSWITCH 1.11.2 and earlier for CVE-2026-116779, with a fix in 1.11.3; CVE-2026-116785 and CVE-2026-116790 affect FreeSWITCH 1.11.1 and earlier, with fixes in 1.11.2.

The advisory recommends upgrading to FreeSWITCH 1.11.3 and applying configuration changes: keep enable-chat-api-proto off by default, enable-ice message integrity checks via the ice_verify_message_integrity channel variable, disable SIP chat on profiles that do not require it, remove passwordless directory users, and either leave enable-websocket unset in mod_xml_rpc or firewall the related port. The report notes that the exploit status is “exploited in the wild” for CVE-2026-116779, with the others not yet demonstrated as exploited.