FreeSWITCH CVE-2026-116779 (CVSS 9.8) Exploited: A SIP MESSAGE With an 'api+' Selector Runs System Commands on Phone Servers — Fixed Quietly in 1.11.3, Now in CISA KEV

Critical · 2026-11-10 · By H.A

A crafted SIP MESSAGE can make SignalWire FreeSWITCH run its internal API, including system commands, and the flaw is exploited in the wild and listed in CISA KEV, so upgrade to 1.11.3 or disable SIP chat.

Overview

CISA added CVE-2026-116779, a code-injection flaw in the open-source telephony platform SignalWire FreeSWITCH, to its Known Exploited Vulnerabilities catalog on 9 November 2026. FreeSWITCH runs many call centres, hosted PBX services, carrier SIP gateways and conferencing products. The flaw is rated CVSS 9.8.

A crafted SIP MESSAGE can make FreeSWITCH run its own internal API commands, including system, which runs operating-system commands. SignalWire's advisory, published 28 October 2026, says exploitation has been observed in the wild. The fix shipped quietly in FreeSWITCH 1.11.3 on 28 August 2026, two months before the public advisory.

The Vulnerability

FreeSWITCH supports SIP instant messaging ("chat"). When a MESSAGE arrives, the handler in sofia_presence.c takes the part of the To user before the first + as the chat protocol name. It does not restrict which protocol a sender can choose.

One of the registered chat protocols is api, provided by mod_dptools. Its handler URL-decodes the address, splits it at the first space and passes the result to switch_api_execute(). So a sender who picks the api protocol can run any FreeSWITCH API command with the privileges of the FreeSWITCH process, including:

• system, which runs shell commands
• commands that reveal configuration and credentials, such as SIP trunk passwords
• call control and originate commands, which can be abused for toll fraud
• module loading, and inline Lua where mod_lua is loaded

Authentication offers little protection in stock deployments. auth-messages has been on by default since 1.10.7, so a sender needs an account on a profile that accepts chat. But the stock default directory user has no password and no a1-hash. Many installs built from the example configuration are therefore exploitable without credentials. The inbound ACL does not apply to MESSAGE requests, so tightening ACLs alone does not close the hole.

FreeSWITCH usually runs as an unprivileged service account, and the advisory does not claim root access. That account can still read the full telephony configuration and control every call on the box.

Affected: all releases before 1.11.3, including the whole 1.10 branch and 1.11.0–1.11.2.

Timeline

• 26 August 2026: The fix is committed (PR #3135).
• 28 August 2026: FreeSWITCH 1.11.3 is released.
• 28 October 2026: SignalWire publishes advisory GHSA-mg63-h38w-8p9p and says exploitation has been observed.
• 5 November 2026: CVE-2026-116779 is published.
• 9 November 2026: CISA adds the flaw to KEV.

Tradecraft

SignalWire has not published victim counts, dates or indicators. The attack needs only a single SIP request, usually over UDP 5060, so internet-wide scanning is cheap. VoIP infrastructure has long been a target for toll-fraud crews, who resell premium-rate and international call capacity. They will value API access that can originate calls, as well as shell access that can steal trunk credentials. Shell access on a telephony server also makes it possible to record or redirect calls, so espionage use is possible too.

Indicators of Compromise

No IOCs have been published. Treat these as signs of compromise:

• SIP MESSAGE requests whose To user starts with api+
• Unexpected outbound calls or bursts of international or premium-rate calls in CDRs
• New files in FreeSWITCH spool, script or scripts/ directories, or dialplan changes nobody made
• New registrations from unfamiliar IP addresses
• Shell or download utilities started as the FreeSWITCH service user

Detection

• Search SIP captures and logs for the api chat selector:

grep -E 'MESSAGE sip:api(\+|%2B)' /var/log/freeswitch/*.log
# with a SIP capture
tshark -r capture.pcap -Y 'sip.Method == "MESSAGE" && sip.to.user contains "api+"'

• On 1.11.3 and later, blocked attempts are rejected with 403 and logged with the source address. Alert on those warnings, because they show someone is probing.
• Versions before 1.11.3 may log nothing distinctive. Look for the side effects instead: process trees under freeswitch that include sh or bash, unexpected curl or wget calls, and odd call patterns in CDRs.
• Check whether mod_lua is loaded (fs_cli -x 'module_exists mod_lua'). If it is, the attacker had more options.

Recommended Actions

1. Upgrade to FreeSWITCH 1.11.3 or later and restart. If you build your own packages, rebuild both mod_sofia and mod_dptools. The fix adds an enable-chat-api-proto profile flag that is off by default. Leave it off.
2. If you cannot upgrade, set enable-chat to false on every SIP profile that does not need messaging.
3. Remove directory users that have no password or a1-hash, and set allow-empty-password to false. This narrows exposure but does not remove it.
4. disable_system_api_commands=true blocks only system. Other dangerous APIs stay reachable, so treat it as defence in depth, not a fix.
5. If you cannot rule out exploitation, rebuild the host, rotate all SIP, trunk and API credentials, and check CDRs and carrier bills for fraud.
6. Do not expose SIP signalling directly to the internet. Put an SBC or carrier allow-list in front of it.

Analyst Assessment

This is a design flaw in a rarely used feature, SIP chat, that turns into full command execution because of insecure example defaults. The two-month gap between the silent fix and the advisory means many operators never saw a reason to upgrade. VoIP servers also tend to be patched rarely because downtime hurts the business. Expect exploitation to keep growing now that the advisory and KEV listing describe the mechanism. Toll fraud is the most likely immediate impact, and stolen trunk credentials and call interception are realistic follow-ups.