Threat watch / Vulnerability
FreeSWITCH: a crafted SIP message runs API commands on phone servers, exploited in the wild
FreeSWITCH, the open-source telephony server maintained by SignalWire, let an incoming SIP MESSAGE with a plus sign in the recipient's user name reach its api chat handler, which runs FreeSWITCH API commands. It works on the default setup when the attacker has one registered account, or with the empty-password default user of the stock configuration. The project fixed it in 1.11.3 on October 28, 2026 and says exploitation has been observed in the wild. CISA added it to its list of exploited flaws on November 9, 2026, according to The Hacker News.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- FreeSWITCH, SignalWire
- How it happened
- A flaw in SIP MESSAGE handling (CVE-2026-116779, CVSS 9.8): in FreeSWITCH 1.11.2 and earlier, a message whose To user contains a "+" can select the api chat protocol and run FreeSWITCH API commands. It needs a profile that accepts MESSAGE (the default) and either one registered account or the empty-password default user shipped in conf/vanilla.[1] Checked 11 Nov 2026
- What was stolen
- Not public yet Checked 11 Nov 2026
- Who was impacted
- Organizations running FreeSWITCH 1.11.2 or earlier with chat enabled on a profile that accepts SIP MESSAGE. The project says exploitation has been observed but gives no number of victims.[1] Checked 11 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-116779
Timeline
- SignalWire publishes advisory GHSA-mg63-h38w-8p9p and fixes the flaw in FreeSWITCH 1.11.3, credited to Örn Arnarson and Gunnlaugur. It states that "exploitation of this path has been observed in the wild" and suggests setting enable-chat=false on profiles that do not need chat. [1]
- CISA adds CVE-2026-116779 to its Known Exploited Vulnerabilities catalog, according to The Hacker News; no attacker is named. [2]