Global News | November 10, 2026

A FreeSWITCH vulnerability is being exploited in the wild, raising concerns for organizations that rely on the open-source communications platform to operate voice, messaging and contact-center services. The flaw, tracked as CVE-2026-116779, can allow a party able to deliver an accepted SIP message to run commands with the privileges of the FreeSWITCH process.

SignalWire’s FreeSWITCH project rates the issue critical, with a CVSS v3.1 score of 9.8 out of 10. Its advisory identifies versions 1.11.2 and earlier as affected and version 1.11.3 as the fixed release. The US Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog on November 9, 2026.

The project says exploitation has been observed, but the advisory does not identify the victims, specify when the attacks occurred or establish that call recordings or customer information were stolen. The severity of the issue comes from the capabilities available through a successful attack, not from a publicly verified count of compromised organizations.

For administrators, the immediate priorities are to identify affected installations, apply a supported fix and review exposed systems for suspicious activity. Companies using hosted phone systems or third-party products built on FreeSWITCH should also ask their providers whether the affected component is present and how it has been secured.

1. What the FreeSWITCH Vulnerability Allows

FreeSWITCH is an open-source software platform used to build and operate communications services. Depending on the deployment, it can support voice calls, messaging, contact centers and other applications that use the Session Initiation Protocol, or SIP.

The FreeSWITCH vulnerability concerns the handling of an inbound SIP MESSAGE request. The project’s advisory says that part of an incoming message’s destination is interpreted as a chat protocol selector. One registered interface can pass information to the FreeSWITCH API, enabling commands to be executed if the message is accepted by a vulnerable profile.

The distinction between receiving network traffic and accepting a message matters. Practical exposure depends on how a SIP profile is configured, which peers can reach it and whether its authentication requirements can be satisfied. The advisory nevertheless describes a default configuration in which chat handling is enabled, and it warns that an inbound access-control list used for calls does not cover this MESSAGE path.

If exploitation succeeds, the project says the resulting commands run with the privileges of the FreeSWITCH process. Potential outcomes include operating-system command execution, disclosure of configuration and credentials, and control over calls. The available advisory does not establish that all of those outcomes occurred in the observed exploitation.

2. What Has Been Confirmed and When

SignalWire’s project published its security advisory on October 28, 2026. The advisory identifies the affected versions and the first fixed release, assigns the critical severity rating and states that exploitation of the path has been observed in the wild.

On November 9, CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog as part of an alert covering four flaws. The agency said the additions were based on evidence of active exploitation. Its notice encourages organizations to prioritize remediation using risk-based vulnerability management.

Independent technical reporting has also described the FreeSWITCH vulnerability and the available fix. The reporting and the project advisory point to an important distinction: the date a vulnerability is publicly discussed is not necessarily the date it was first exploited. Neither the project’s description nor CISA’s alert provides a full public account of the observed incidents.

CISA’s alert discusses requirements under its risk-based directive for US federal civilian executive branch agencies. Other organizations are not automatically subject to those federal requirements, though the agency encourages them to prioritize known exploited vulnerabilities.

3. Which Systems Could Be Affected?

The project lists FreeSWITCH versions 1.11.2 and earlier as affected and identifies 1.11.3 or later as patched for this issue. Organizations should confirm the version running on each server rather than relying on the version of a management dashboard or a software package label alone.

FreeSWITCH can be deployed directly or included in a larger communications product. A company may therefore depend on the affected software without managing it under the FreeSWITCH name. Businesses should check production, backup, test and externally managed environments, including any hosted services where a provider operates the underlying platform.

The advisory says profiles that accept inbound SIP MESSAGE traffic are in scope. It describes chat handling as enabled by default unless the profile explicitly disables it. It also says both internal and external profiles in the stock example configuration leave chat enabled.

Where message authentication is enforced, the project says an account capable of registering on the profile can be sufficient to reach the vulnerable functionality. It also describes a passwordless default directory user in an example configuration that can weaken the authentication barrier in installations retaining it. Administrators should check their actual settings; a default example configuration is not proof of the configuration of every installation.

4. Seven Critical Risks for Communications Systems

The following are potential consequences described by the project or arising from the capabilities it identifies. They do not claim that every vulnerable organization has experienced an incident.

1. Server command execution: A successfully accepted malicious message can lead to FreeSWITCH API commands and, as the advisory explains, operating-system commands under the FreeSWITCH process account. The effective damage depends in part on that account’s permissions.
2. Configuration disclosure: Attackers may be able to access configuration information that helps them understand the environment or identify other services. The project lists configuration disclosure as a possible impact, not a confirmed outcome for every exploited deployment.
3. Credential exposure: Communications systems may contain credentials for related services, devices or integrations. If an attacker can obtain them, the impact may extend beyond the original server, depending on their permissions and reuse.
4. Unauthorized call control: The advisory identifies full call control as a potential consequence. This could affect the integrity of communications workflows, but the public advisory does not establish which call actions occurred in the observed exploitation.
5. Persistence after patching: If an attacker obtained access before a fix was applied, unauthorized accounts, changes or credentials might remain. An upgrade addresses the vulnerable route; it does not automatically establish that an environment is clean.
6. Service disruption: Investigating a suspected compromise, isolating a server or rebuilding a communications environment may interrupt business operations. Disruption is a potential operational consequence, not a loss quantified in the project’s advisory.
7. Downstream organizational exposure: A communications server may connect employees, customers, third-party carriers and other internal systems. An incident can create broader investigation and notification questions, but the scope depends on verified activity and the environment’s configuration.

The FreeSWITCH vulnerability should therefore be evaluated as both a software patching issue and a possible incident-response issue. A high severity score signals serious technical potential; it does not prove that a particular organization was compromised.

5. The Fix and Temporary Workarounds

For the FreeSWITCH vulnerability, the project identifies version 1.11.3 as the fixed release. The change introduces a per-profile setting that controls whether an inbound message can select the API chat protocol. According to the advisory, that setting is off unless explicitly enabled, closing the route by default.

Administrators should review current vendor guidance and select a supported release that includes the fix. They should also validate their configuration after upgrading: deliberately re-enabling the relevant protocol changes the security posture and should be assessed against the organization’s requirements.

For profiles that do not require inbound SIP chat, the project recommends setting enable-chat=false. The advisory says this stops the affected message path before the protocol selector is parsed, but it also disables inbound MESSAGE chat delivery on that profile. Teams should evaluate the operational impact and coordinate the change with service owners.

The project cautions that auth-messages alone is not sufficient to close the path. Removing directory users that have neither a password nor an authentication hash reduces exposure, but an account that can register may still be enough where message authentication is enforced. Similarly, the project says disable_system_api_commands=true removes one API but does not close the broader route.

Network restrictions remain useful defense in depth, but the advisory specifically warns that the inbound access-control list it discusses does not cover MESSAGE requests. Administrators should not assume that a control intended for call traffic protects this separate message path.

6. What Organizations Should Do Now

Organizations should begin by building an inventory of FreeSWITCH deployments and the products or services that depend on them. Include servers operated by infrastructure, communications, customer-service and development teams. For managed services, obtain a clear answer from the provider rather than assuming the underlying component is unaffected.

Apply the project’s fix through a supported upgrade path and test critical calling and messaging functions. If immediate upgrade is not possible, assess whether the documented chat-disabling workaround can be applied to profiles that do not need inbound SIP chat. Record where temporary measures are used and plan for a permanent update.

Because the FreeSWITCH vulnerability has been exploited in the wild, security teams should also consider whether affected instances were exposed before remediation. Preserve available logs and review relevant SIP MESSAGE activity, FreeSWITCH API actions, process activity, configuration changes and account changes using the organization’s incident-response procedures.

After upgrading, the advisory says requests that attempt to select the disabled API protocol receive a rejection and are logged with the source and requested command. Those records may support ongoing monitoring, but their absence does not establish that earlier exploitation did not occur. The available historical visibility depends on what the system logged before the upgrade and whether those records remain available.

If investigators find signs of unauthorized activity, they should assess the permissions of the FreeSWITCH process, review connected systems and rotate credentials that may have been exposed. Decisions about isolation, forensic preservation, rebuilding and notification should follow the organization’s response plan and verified findings.

7. What Remains Unknown

The project confirms observed exploitation but does not publicly name the affected organizations or identify an attacker. Its advisory does not provide a victim count, a detailed incident timeline or evidence that specific call recordings or personal data were taken.

CISA’s catalog listing is a strong indication that exploitation evidence exists, but its alert does not disclose the complete circumstances of the attacks. Neither the catalog listing nor the existence of a vulnerable version establishes that a particular server was compromised.

Important questions for an affected operator include whether its SIP profiles accepted relevant traffic, whether suspicious requests were logged, whether configuration or credentials were accessed and whether unauthorized changes persist. Those questions require examination of the operator’s own environment.

The FreeSWITCH vulnerability also illustrates why communications infrastructure should be included in routine vulnerability management. Telephone and messaging servers can be as operationally important as conventional web applications, while their software components and network exposure may be managed by different teams.

Conclusion

CVE-2026-116779 is an actively exploited FreeSWITCH vulnerability that can permit command execution through accepted SIP MESSAGE traffic. The project identifies versions through 1.11.2 as affected and 1.11.3 as fixed; exposure and practical attack prerequisites depend on the deployment.

Organizations should identify affected systems, apply a supported fix, assess temporary workarounds where necessary and investigate potential earlier compromise. Providers and customers should communicate clearly about the systems they operate and the evidence available, without assuming that a vulnerable installation has necessarily been breached.

Source note: This report draws on the FreeSWITCH project’s security advisory, CISA’s Known Exploited Vulnerabilities alert and independent reporting by Daily CyberSecurity. Confirmed exploitation is distinguished from possible impacts and details that remain unknown.

NewsFlayer — Bringing You the Latest Cybersecurity News from Around the World.