FreeSWITCH CVE-2026-116779 exploited: one SIP MESSAGE runs commands

If your phone system runs on FreeSWITCH, one text message can own it. FreeSWITCH CVE-2026-116779 is a CVSS 9.8 flaw in how the open-source telephony engine handles inbound SIP MESSAGE requests. SignalWire's advisory says exploitation "has been observed in the wild," and on November 9 CISA added it to the Known Exploited Vulnerabilities catalog.

What actually happened

From GitHub advisory GHSA-mg63-h38w-8p9p, published October 28:

• The bug. FreeSWITCH splits the To user of an inbound SIP MESSAGE on + and treats the left half as a chat protocol name. mod_dptools registers an api chat protocol that passes the message to switch_api_execute(). So the sender picks the API command the server runs.
• Impact. OS commands with the FreeSWITCH process's privileges, leaked config and credentials, and full call control. If mod_lua is loaded, which the stock config does, inline Lua is a second path.
• Default exposure. Chat is on unless a profile sets enable-chat=false, and the stock vanilla config leaves it on for both internal and external profiles. The inbound ACL doesn't cover MESSAGE.
• Credentials don't save you. With message auth on, any one account on the profile is enough. Installs that kept the vanilla default directory user, which has no password, need no account at all.
• Fix. Versions through 1.11.2 are affected. 1.11.3 adds an enable-chat-api-proto setting that is off by default and returns 403 on attempts.

Same CISA batch: IBM Aspera Faspex CVE-2026-123218, a CVSS 9.8 authorization bypass in 5.0.0 through 5.0.19 that lets a logged-in user become admin. Fix: 5.0.19 PL1.

Why it matters for your business

FreeSWITCH is the engine under plenty of small-business phone systems, including open-source PBX front ends like FusionPBX and some hosted VoIP resellers. You may run it without knowing the name. A compromised PBX means call fraud on your bill, recorded calls walking out, and a shell on a box that usually sits on your internal network.

1. Find out if you run it. Ask your phone vendor or IT contractor directly: "Is our PBX on FreeSWITCH, and what version?"
2. Update to 1.11.3. Then confirm enable-chat-api-proto stays off.
3. Can't update today? Set enable-chat=false on every SIP profile that doesn't need inbound chat. The advisory says turning on message auth alone does not close the hole, and neither does disabling the system API.
4. Delete passwordless directory users. The vanilla default user should not exist in production.
5. Check for damage. Review call records for odd international calls and look for processes or cron jobs you didn't create.

Sources: SignalWire advisory GHSA-mg63-h38w-8p9p, CISA, IBM security bulletin.