FreeSWITCH Flaw Exploited: Upgrade Phone Servers to 1.11.3

A FreeSWITCH flaw tracked as CVE-2026-116779 is being exploited. SignalWire, which maintains the project, published an advisory on 28 October 2026 rating it 9.8 (Critical). A single SIP message accepted by the server can run operating system commands. Versions 1.11.2 and earlier are affected, and the fix ships in FreeSWITCH 1.11.3.

A phone server that takes orders by message

FreeSWITCH is open-source software for building internet telephony (VoIP) systems. Its official repository describes it as a software-defined telecom stack that runs on anything from a Raspberry Pi to a multi-core server. In practice it often powers office PBXs, complaint hotlines, and contact centers.

These systems talk over SIP. Besides voice calls, SIP has a request type called MESSAGE for sending text between users. According to advisory GHSA-mg63-h38w-8p9p, the mod_sofia module reads the part of the destination address before a + sign as the name of a chat protocol. When that name is api, the message body goes straight to FreeSWITCH’s API executor.

As a result, an outside party that can deliver one MESSAGE request can run API commands, including operating system commands, with the privileges of the FreeSWITCH process. The advisory also lists exposure of configuration and credentials and full control over calls. If mod_lua is loaded, inline Lua offers a second route.

SignalWire classifies the weakness as CWE-77, CWE-78, and CWE-749. The issue was reported by Örn Arnarson and Gunnlaugur.

Exploitation status and scope

SignalWire’s advisory states that exploitation has been observed in the wild. Security firm Rescana notes, however, that the advisory gives no dates, victim counts, or indicators of compromise. As of 29 October 2026, Rescana found that the flaw was not yet in CISA’s Known Exploited Vulnerabilities (KEV) catalog and had no NVD record.

The reach is wide because the default settings are exposed. Any SIP profile that accepts inbound MESSAGE requests is affected, and that is the default behavior. The sample profiles in the vanilla configuration leave chat enabled. The advisory adds that the inbound access control list (ACL) does not cover MESSAGE, so IP restrictions set up for calls may not protect this path.

The bar for an attack is low. When MESSAGE authentication is enforced, any single registered account on the profile is enough. Installations that still carry the stock default directory user with no password or a1-hash may require no account at all.

A fix has been available since August

Timing is the detail administrators most need to know. The advisory only went public on 28 October, but the fix shipped much earlier. According to the FreeSWITCH releases page and Rescana, version 1.11.3 came out on 28 August 2026. Its release notes mention a bounded split of the destination address in the mod_sofia MESSAGE handler and a new gate for the chat API protocol.

Servers that have been updated routinely since late August are already protected. Servers left on 1.11.2 or older remain open. Rescana also notes that no fixed 1.10.x release is listed, so anyone on the older branch needs to move to 1.11.

Version 1.11.3 adds a per-profile enable-chat-api-proto parameter that is off by default. With it off, MESSAGE requests that select the api protocol receive a 403 response and are logged with the source and the requested command. Those log entries help teams spot attack attempts after the upgrade.

The previous release, 1.11.2 on 9 August 2026, brought security hardening across many modules. According to Rescana, 20 other advisories published alongside this one were fixed in that version, and 1.11.3 includes all of them.

Other flaws in the same batch

SignalWire published several other advisories at the same time. Two of them are also rated critical at 9.1, though neither has been reported as exploited. CVE-2026-116790 concerns ICE/STUN integrity checks on WebRTC calls, and its fix must be switched on through the ice_verify_message_integrity variable. CVE-2026-116785 concerns a WebSocket endpoint in mod_xml_rpc that is only exposed when that module is in use.

There is also CVE-2026-116786, rated 8.8, in SIP REFER handling. It requires an account and is enabled by default. Rescana lists disable-transfer=true on the affected profile as the mitigation, which also disables SIP-initiated call transfers. Several of these new protections have to be turned on manually after the upgrade.

What this means for contact center operators

Many public services depend on the telephone: complaint lines at local government offices, hospital call centers, and the contact centers of banks and companies. If the engine underneath is an unpatched FreeSWITCH server, an attacker can take over the machine, read the credentials for phone trunks, or control calls. For government agencies, that touches public trust in a channel citizens use every day.

IT teams or the vendors that run these phone servers can take the following steps now.

1. Check the version. Make sure every FreeSWITCH server, including backup and test servers reachable from the internet, runs 1.11.3 or later.
2. Disable unused SIP chat. Set enable-chat to false on every SIP profile that does not need text messaging. According to the advisory, this is the only measure that fully closes the attack path when the upgrade cannot be installed yet.
3. Remove passwordless accounts. Look for directory users with no password or a1-hash, including sample users from the stock configuration. Keep MESSAGE authentication on, which has been the default since 1.10.7.
4. Leave enable-chat-api-proto off. The new parameter is disabled by default. Turn it on only for a clear need and a trusted message source.
5. Review the logs. Look for unusual inbound MESSAGE traffic, API activity that cannot be explained, and unfamiliar processes run by the FreeSWITCH user. Rescana recommends going back to the period when the server ran a vulnerable version with chat enabled.

Other stopgaps have limits. The disable_system_api_commands=true option removes only the system API command, so other dangerous API commands remain reachable. MESSAGE authentication only reduces the risk, since a single registered account is enough to attack.

Many agencies do not manage their phone servers themselves. Government contact centers are often installed by a vendor and left running for years without updates. Ask the vendor to state in writing which FreeSWITCH version is installed and when it will be upgraded. The same habit applies to every public-facing digital service, as covered in Merakit’s digital government solutions. For an inventory of internet-facing systems and testing after the upgrade, our cybersecurity services can help.

The pattern resembles the recent PHP2Shell flaws: software running in the background tends to fall off the update schedule even though it faces the internet directly.

Frequently asked questions

Is my server safe if we never use the chat feature?

Not necessarily. Chat is enabled by default in the sample vanilla profiles, so a server can accept MESSAGE requests even if your team has never used them. Check the enable-chat value on every SIP profile, then upgrade to 1.11.3.

What about products built on top of FreeSWITCH?

Many PBX and contact center platforms use FreeSWITCH as their engine. Ask the platform provider which FreeSWITCH version they bundle and whether the 1.11.3 fix is included. Also search the provider’s security notices for CVE-2026-116779.

Is blocking IP addresses enough?

Not on its own. The advisory says the inbound ACL does not cover MESSAGE requests. Network restrictions still help reduce exposure, but the upgrade and the enable-chat setting should be handled as well.

Closing thoughts

This FreeSWITCH flaw is a reminder that phone servers are part of an organization’s attack surface. The fix has been available since August, so the most important step is straightforward: confirm that 1.11.3 is installed and that unused SIP chat is turned off. If your team needs support mapping and testing phone systems and other digital public services, Merakit is ready to talk.

Sources

• SignalWire: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands (GHSA-mg63-h38w-8p9p) (28 October 2026)
• FreeSWITCH Releases on GitHub (v1.11.3, 28 August 2026; v1.11.2, 9 August 2026)
• Rescana: FreeSWITCH CVE-2026-116779, Critical SIP MESSAGE Flaw Exploited in the Wild, Fixed in 1.11.3 (29 October 2026)
• Official FreeSWITCH repository