FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories

SignalWire published GitHub advisories for FreeSWITCH, the open-source telephony switch behind FusionPBX and many VoIP platforms. The critical one, CVE-2026-116779 (CVSS 9.8), lets anyone who can get a SIP MESSAGE accepted address it to the api chat proto and have FreeSWITCH run any API command, including system for OS commands and inline Lua where mod_lua is loaded. Inbound chat is on by default, the inbound ACL does not cover MESSAGE, and one registered SIP account (or the stock passwordless default directory user) is enough. The advisory says exploitation has been observed in the wild. It is fixed in 1.11.3 (released Aug 28), which adds an enable-chat-api-proto setting that is off by default. Oct 26 and Oct 28 advisories also cover pre-auth memory bugs in mod_xml_rpc WebSocket handling (CVE-2026-116785, CVSS 9.1), ICE checks accepted without STUN MESSAGE-INTEGRITY (CVE-2026-116790, CVSS 9.1), SIP REFER channel-variable injection leading to command execution (CVE-2026-116786), and overflows in mod_rtmp, MSRP, SDP crypto and the Event Socket, all fixed in 1.11.2. Upgrade to 1.11.3.

Why this severity: CVE-2026-116779 is CVSS 9.8 and exploited in the wild per the advisory; it needs one accepted SIP MESSAGE, which default configs allow for any registered account

Started

Oct 28, 2026

CVEs

CVE-2026-116779CVE-2026-116785CVE-2026-116790CVE-2026-116786

• #Signalwire
• #Freeswitch
• #Fusionpbx
• #Voip
• #Sip
• RCE
• #Command Injection
• #Exploited