{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories · updates",
  "home_page_url": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779",
  "feed_url": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779/feed.json",
  "description": "SignalWire published GitHub advisories for FreeSWITCH, the open-source telephony switch behind FusionPBX and many VoIP platforms. The critical one, CVE-2026-116779 (CVSS 9.8), lets anyone who can get a SIP MESSAGE accepted address it to the api chat proto and have FreeSWITCH run any API command, including system for OS commands and inline Lua where mod_lua is loaded. Inbound chat is on by default, the inbound ACL does not cover MESSAGE, and one registered SIP account (or the stock passwordless default directory user) is enough. The advisory says exploitation has been observed in the wild. It is fixed in 1.11.3 (released Aug 28), which adds an enable-chat-api-proto setting that is off by default. Oct 26 and Oct 28 advisories also cover pre-auth memory bugs in mod_xml_rpc WebSocket handling (CVE-2026-116785, CVSS 9.1), ICE checks accepted without STUN MESSAGE-INTEGRITY (CVE-2026-116790, CVSS 9.1), SIP REFER channel-variable injection leading to command execution (CVE-2026-116786), and overflows in mod_rtmp, MSRP, SDP crypto and the Event Socket, all fixed in 1.11.2. Upgrade to 1.11.3.",
  "language": "en",
  "_pwn": {
    "slug": "freeswitch-api-chat-rce-cve-2026-116779",
    "severity": "critical",
    "status": "live",
    "patchStatus": "patched",
    "rss": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779/feed.xml",
    "llms": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779/llms.txt",
    "json": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779#2026-10-28-ff065c53",
      "url": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779#2026-10-28-ff065c53",
      "title": "FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories: SignalWire publishes the critical api chat proto advisory (CVE-2026-116779, CVSS 9.8, exploitation observed in the wild) plus critical mod_xml_rpc WebSocket (CVE-2026-116785) and ICE MESSAGE-INTEGRITY (CVE-2026-116790) advisories.",
      "content_text": "FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories: SignalWire publishes the critical api chat proto advisory (CVE-2026-116779, CVSS 9.8, exploitation observed in the wild) plus critical mod_xml_rpc WebSocket (CVE-2026-116785) and ICE MESSAGE-INTEGRITY (CVE-2026-116790) advisories.\n\nSource: https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p",
      "date_published": "2026-10-28T00:00:00.000Z",
      "external_url": "https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779#2026-10-26-eb4c8c22",
      "url": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779#2026-10-26-eb4c8c22",
      "title": "FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories: SignalWire publishes a first batch of FreeSWITCH advisories: pre-auth overflows in mod_xml_rpc, MSRP, mod_rtmp and SDP a=crypto parsing, fixed in 1.11.2.",
      "content_text": "FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories: SignalWire publishes a first batch of FreeSWITCH advisories: pre-auth overflows in mod_xml_rpc, MSRP, mod_rtmp and SDP a=crypto parsing, fixed in 1.11.2.\n\nSource: https://github.com/signalwire/freeswitch/security/advisories",
      "date_published": "2026-10-26T00:00:00.000Z",
      "external_url": "https://github.com/signalwire/freeswitch/security/advisories",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779#2026-08-28-53115e6a",
      "url": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779#2026-08-28-53115e6a",
      "title": "FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories: FreeSWITCH 1.11.3 ships as an important release with critical security fixes; Enable Security reports servers being taken over in the wild through the api-chat path, including a compromised FusionPBX box.",
      "content_text": "FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories: FreeSWITCH 1.11.3 ships as an important release with critical security fixes; Enable Security reports servers being taken over in the wild through the api-chat path, including a compromised FusionPBX box.\n\nSource: https://www.enablesecurity.com/newsletter/2026-08-rtcsec-news/",
      "date_published": "2026-08-28T00:00:00.000Z",
      "external_url": "https://www.enablesecurity.com/newsletter/2026-08-rtcsec-news/",
      "tags": [
        "critical"
      ]
    },
    {
      "id": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779#2026-08-09-41785891",
      "url": "https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779#2026-08-09-41785891",
      "title": "FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories: SignalWire releases FreeSWITCH 1.11.2, which fixes most of the memory-safety and protocol bugs later published as advisories in October.",
      "content_text": "FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories: SignalWire releases FreeSWITCH 1.11.2, which fixes most of the memory-safety and protocol bugs later published as advisories in October.\n\nSource: https://github.com/signalwire/freeswitch/releases/tag/v1.11.2",
      "date_published": "2026-08-09T00:00:00.000Z",
      "external_url": "https://github.com/signalwire/freeswitch/releases/tag/v1.11.2",
      "tags": [
        "critical"
      ]
    }
  ]
}