If you manage hosted voice, check which FreeSWITCH profiles accept inbound SIP messages. An attacker who can deliver one to a vulnerable profile may run commands as the FreeSWITCH process.
Original vendor advisory October 28, 2026. Last verified November 9, 2026. Vendor severity Critical, CVSS 3.1 9.8. Suggested MSP priority Urgent for exposed affected deployments.
What changed on November 9
CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog on November 9 and marked it for forensic triage. The federal remediation due date is November 12, 2026. SignalWire reports exploitation in the wild.
Check applicability
FreeSWITCH 1.11.2 and earlier. A SIP profile must accept inbound MESSAGE, which is enabled in stock internal and external profiles. When MESSAGE authentication is enforced, an ordinary extension or trunk account can suffice. Stock directory entries with no password or digest can make the path reachable without the attacker’s own account when empty-password authentication is allowed. The inbound ACL does not cover MESSAGE.
Contain, patch and verify
1. Inventory standalone, bundled and hosted PBX instances. Confirm the installed build, reachable SIP profiles, inbound chat settings and vendor support for the upgrade.
2. If the upgrade must wait, set enable-chat=false on profiles that can forgo inbound SIP chat. This disables inbound SIP chat delivery there. MESSAGE authentication alone leaves an authenticated command path. Restrict access at the network boundary where feasible.
3. Upgrade to 1.11.3 or later. Leave enable-chat-api-proto off, as it is by default in the fix. Confirm the version and profile settings and test ordinary calls and expected messaging after rollout.
4. Preserve relevant SIP, FreeSWITCH and host logs. Review unusual commands, account changes, calls and outbound connections. If compromise is suspected, isolate the host and assess rotation of potentially exposed SIP, trunk and service credentials.
Official sources
Vendor advisory GHSA-mg63-h38w-8p9p · CISA KEV catalog · CVE Program record · CISA forensic triage guidance