FreeSWITCH CVE-2026-116779: critical code injection exploited

What it is and who is affectedSignalWire FreeSWITCH is a software-defined telecom stack used to run voice platforms on commodity hardware. A code inje...

What it is and who is affected

SignalWire FreeSWITCH is a software-defined telecom stack used to run voice platforms on commodity hardware. A code injection flaw tracked as CVE-2026-116779 affects the product up to version 1.11.3, not including it — that is, every release before 1.11.3. It was published in the NIST National Vulnerability Database on 5 November 2026 and carries a CVSS 3.1 score of 9.8, rated CRITICAL (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The weakness maps to CWE-77, CWE-78 and CWE-749.

According to the NVD description, the function sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left-hand side as a chat protocol selector. Choosing the api chat proto reached switch_api_execute(), letting a peer whose MESSAGE was accepted run FreeSWITCH API commands — including operating-system command sinks — with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is enough; stock directory users without password material can also remove that barrier in affected configurations. The result is configuration and credential disclosure, arbitrary call control and command execution.

In practice this concerns any organisation running FreeSWITCH itself or through a provider: call centres, VoIP resellers, contact platforms and businesses with an on-premise PBX. If you host it on your own servers or rely on a small IT team, the exposure is yours to close.

Why it is urgent

This is not a theoretical flaw. CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities (KEV) catalogue on 9 November 2026, which means exploitation has been observed in real attacks. CISA gave US federal agencies until 12 November 2026 to correct it, and requires mitigations in line with the vendor's instructions, following its BOD 26-04 guidance on prioritising security updates by risk, plus its forensics triage requirements. For cloud services, the same guidance applies or the product should be discontinued if no mitigation is available.

There is no known use in ransomware campaigns recorded in the source data, but the combination of a critical score, network reachability without privileges or user interaction, and confirmed in-the-wild exploitation puts it at the top of any patching queue. A voice platform that can be made to execute commands is also a foothold into the rest of the network, and any credentials it holds fall under GDPR obligations towards customers and staff.

What to do today

Check whether you run FreeSWITCH and in which version. Anything below 1.11.3 is affected. Include instances managed by third parties, test environments and forgotten staging boxes.
Update to 1.11.3, the version in which the issue is fixed, following the vendor's release notes and security advisory. If you cannot update immediately, apply the mitigations described in the vendor advisory and in the referenced patch.
Review for signs of intrusion. Look for unexpected API commands, unusual call routing, unfamiliar configuration changes and anomalous outbound connections. If you suspect compromise, preserve logs before cleaning anything.
Reduce what is exposed to the internet. Restrict SIP and management interfaces to known peers, remove default or passwordless directory users, and disable inbound chat where it is not needed.
Rotate credentials held by the platform once you have verified the system is clean, since disclosure is one of the documented consequences.

How a cybersecurity team like ALMC's can help

For SMEs and small IT departments in Barcelona, Lleida, Tarragona or Girona, keeping track of advisories like this one alongside day-to-day operations is hard. At ALMC we work on the practical side: security audits and pentesting to find what is exposed before someone else does, server hardening, and monitoring with incident response when something looks wrong. We also handle maintenance and updates of WordPress, PrestaShop and Joomla sites and repair hacked websites, so the same discipline applied to your voice infrastructure extends to your web estate. If your team needs an extra pair of hands to verify versions, review logs or close exposed services after a critical advisory, that is exactly the kind of work we take on.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.