CVE-2026-116779 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-11-05

Added to CISA KEV: 2026-11-09 4 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL — PATCH IMMEDIATELY: Upgrade FreeSWITCH to version 1.11.3 or later. This vulnerability is confirmed exploited in the wild with public PoC code available.
IMMEDIATE MITIGATION (if patching is delayed): Disable inbound SIP MESSAGE handling on all profiles that do not strictly require it, or restrict SIP access to trusted IP ranges via ACL rules or upstream firewall/SBC.
INCIDENT RESPONSE: Review FreeSWITCH logs for inbound SIP MESSAGE requests where the 'To' header contains a '+' character, particularly those selecting 'api' as the chat proto. Check for unexpected system command execution, unauthorized call activity, or configuration changes.
NETWORK HARDENING: Deploy a Session Border Controller (SBC) or SIP-aware firewall in front of FreeSWITCH to filter and validate SIP traffic before it reaches the application layer.
LEAST PRIVILEGE: Ensure FreeSWITCH runs as a non-root, dedicated service account with minimal OS privileges to limit the impact of daemon-level command execution.
MONITORING: Implement SIP message anomaly detection; alert on SIP MESSAGE packets with unusual 'To' header formatting ('+' delimiters selecting non-standard chat protocols).
THREAT HUNTING: Search for Indicators of Compromise — look for unexpected outbound connections, new files or cron jobs, modified FreeSWITCH configuration files, or evidence of credential harvesting from the host.
PATCH PRIORITY: P1 — Critical. Treat as emergency patch due to active exploitation, unauthenticated RCE, and internet-facing deployment pattern.

🔍 Web Intelligence (Kagi · 2026-11-09)

Summary

CVE-2026-116779 is a critical command injection vulnerability (CWE-78) affecting the SignalWire FreeSWITCH software-defined telecom stack. The flaw exists due to improper input filtering when parsing SIP MESSAGE packets, which allows an unauthenticated attacker to send a specially crafted message that triggers the execution of arbitrary FreeSWITCH API or system-level commands. Because this vulnerability grants attackers the ability to execute unauthorized commands as the FreeSWITCH daemon, it poses a severe threat to the integrity and confidentiality of telephony infrastructure.

Exploitation

Active Exploitation: The vulnerability is currently being exploited in the wild ^[4]^[6].
Tool Availability: Verified proof-of-concept (PoC) exploit code is publicly available ^[1].
Attack Vector: This is a network-based attack; no local access is required ^[3]^[6].
Authentication: Exploitation does not require prior authentication from the attacker ^[3]^[6].
User Interaction: No user interaction is needed to compromise the system ^[3].

Affected Products & Patches

Affected Versions: All releases of SignalWire FreeSWITCH prior to version 1.11.3 ^[2]^[4].
Patch Availability: The vulnerability was addressed and fixed in FreeSWITCH version 1.11.3 ^[4].
Mitigations: Organizations should ensure that inbound SIP MESSAGE handling is disabled on profiles if it is not strictly required, or ensure that access is restricted to trusted networks until systems can be updated to the patched version ^[2].

Impact

Capability: Successful exploitation provides the attacker with the ability to execute arbitrary FreeSWITCH API and OS-level commands with the privileges of the FreeSWITCH daemon ^[5].
Business Risk: For internet-facing deployments, this flaw presents a critical risk, as it allows remote attackers to fully compromise the telephony server, potentially leading to unauthorized access to voice traffic, interception of communications, or further lateral movement into the hosting network ^[1]^[6].

Sources

CVE-2026-116779: affected configurations Command Injection - PoC ...
[PoC Available] CVE-2026-116779 affecting affected configurations (Command Injection) is a Critical severity flaw (CVSS 9.8). FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to... Verified proof-of-concept exploit code, technical b…
CVE-2026-116779 - Vulnerability Details - OpenCVE
The vulnerability exists in all releases of SignalWire FreeSWITCH prior to version 1.11.3. Any instance that has inbound SIP MESSAGE handling enabled on its stock internal or external profiles and accepts authenticated accounts—especially those with directory users lacking password protections—can b…
CVE-2026-116779 - Exploits & Severity
An unauthenticated attacker can send a crafted SIP MESSAGE to trigger this vulnerability and execute arbitrary FreeSWITCH API commands and ... Oct 28, 2026 at 7:53 PM / #vulnerability / Corroborated by 2 other sources CVSS estimate Feedly estimated the CVSS as HIGH based on the CVE details, attack c…
FreeSWITCH CVE-2026-116779: Critical SIP MESSAGE Flaw Exploited in the ...
FreeSWITCH CVE-2026-116779: Critical SIP MESSAGE Flaw Exploited in the Wild, Fixed in 1.11.3 On 28 October 2026, SignalWire, the maintainer of the open-source FreeSWITCH telephony platform, published advisory GHSA-mg63-h38w-8p9p for CVE-2026-116779 (SignalWire GHSA-mg63-h38w-8p9p).
CVE-2026-116779: FreeSWITCH Command Execution via SIP MESSAGE Parsing
What does CVE-2026-116779 mean for system security? This is a Command Injection vulnerability, categorized as CWE-78. It means the software fails to properly filter input when handling specific SIP messages, inadvertently allowing an attacker to run unauthorized system-level commands as if they were…

🔴 CVE-2026-116779