# FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories · pwn.watch

> SignalWire published GitHub advisories for FreeSWITCH, the open-source telephony switch behind FusionPBX and many VoIP platforms. The critical one, CVE-2026-116779 (CVSS 9.8), lets anyone who can get a SIP MESSAGE accepted address it to the api chat proto and have FreeSWITCH run any API command, including system for OS commands and inline Lua where mod_lua is loaded. Inbound chat is on by default, the inbound ACL does not cover MESSAGE, and one registered SIP account (or the stock passwordless default directory user) is enough. The advisory says exploitation has been observed in the wild. It is fixed in 1.11.3 (released Aug 28), which adds an enable-chat-api-proto setting that is off by default. Oct 26 and Oct 28 advisories also cover pre-auth memory bugs in mod_xml_rpc WebSocket handling (CVE-2026-116785, CVSS 9.1), ICE checks accepted without STUN MESSAGE-INTEGRITY (CVE-2026-116790, CVSS 9.1), SIP REFER channel-variable injection leading to command execution (CVE-2026-116786), and overflows in mod_rtmp, MSRP, SDP crypto and the Event Socket, all fixed in 1.11.2. Upgrade to 1.11.3.

Page: https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779 · generated 2026-10-29T06:31:56.147Z

## Status
- Severity: critical · status: live · patch: patched
- Product: SignalWire FreeSWITCH
- Started: 2026-10-28
- CVEs: CVE-2026-116779, CVE-2026-116785, CVE-2026-116790, CVE-2026-116786
- Affected: FreeSWITCH <= 1.11.2 (CVE-2026-116779); FreeSWITCH <= 1.11.1 (the other Oct 2026 advisories)
- Fixed in: FreeSWITCH 1.11.3

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779/feed.xml
- JSON Feed: https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779.json
- This file: https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779/llms.txt

## Updates (newest first)
- 2026-10-28: SignalWire publishes the critical api chat proto advisory (CVE-2026-116779, CVSS 9.8, exploitation observed in the wild) plus critical mod_xml_rpc WebSocket (CVE-2026-116785) and ICE MESSAGE-INTEGRITY (CVE-2026-116790) advisories. (https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p)
- 2026-10-26: SignalWire publishes a first batch of FreeSWITCH advisories: pre-auth overflows in mod_xml_rpc, MSRP, mod_rtmp and SDP a=crypto parsing, fixed in 1.11.2. (https://github.com/signalwire/freeswitch/security/advisories)
- 2026-08-28: FreeSWITCH 1.11.3 ships as an important release with critical security fixes; Enable Security reports servers being taken over in the wild through the api-chat path, including a compromised FusionPBX box. (https://www.enablesecurity.com/newsletter/2026-08-rtcsec-news/)
- 2026-08-09: SignalWire releases FreeSWITCH 1.11.2, which fixes most of the memory-safety and protocol bugs later published as advisories in October. (https://github.com/signalwire/freeswitch/releases/tag/v1.11.2)

## Fix brief
# Security brief: FreeSWITCH: exploited SIP MESSAGE command execution (CVE-2026-116779) plus 20 more advisories

Source: https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779 · status: live · severity: critical · updated Oct 29, 2026, 05:48 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
SignalWire published GitHub advisories for FreeSWITCH, the open-source telephony switch behind FusionPBX and many VoIP platforms. The critical one, CVE-2026-116779 (CVSS 9.8), lets anyone who can get a SIP MESSAGE accepted address it to the api chat proto and have FreeSWITCH run any API command, including system for OS commands and inline Lua where mod_lua is loaded. Inbound chat is on by default, the inbound ACL does not cover MESSAGE, and one registered SIP account (or the stock passwordless default directory user) is enough. The advisory says exploitation has been observed in the wild. It is fixed in 1.11.3 (released Aug 28), which adds an enable-chat-api-proto setting that is off by default. Oct 26 and Oct 28 advisories also cover pre-auth memory bugs in mod_xml_rpc WebSocket handling (CVE-2026-116785, CVSS 9.1), ICE checks accepted without STUN MESSAGE-INTEGRITY (CVE-2026-116790, CVSS 9.1), SIP REFER channel-variable injection leading to command execution (CVE-2026-116786), and overflows in mod_rtmp, MSRP, SDP crypto and the Event Socket, all fixed in 1.11.2. Upgrade to 1.11.3.

Severity detail: CVE-2026-116779 is CVSS 9.8 and exploited in the wild per the advisory; it needs one accepted SIP MESSAGE, which default configs allow for any registered account

- Product: SignalWire FreeSWITCH
- CVE / advisory ids: CVE-2026-116779, CVE-2026-116785, CVE-2026-116790, CVE-2026-116786

## Affected versions
- FreeSWITCH <= 1.11.2 (CVE-2026-116779)
- FreeSWITCH <= 1.11.1 (the other Oct 2026 advisories)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- FreeSWITCH 1.11.3

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
If you run FreeSWITCH or FusionPBX, upgrade to 1.11.3 and leave enable-chat-api-proto unset. Until you can: set enable-chat=false on every SIP profile that does not need inbound chat, remove directory users with no password or a1-hash (stock conf/vanilla ships default and the Skinny example), and set disable_system_api_commands=true (it does not close the path on its own). Check exposed servers for signs of takeover, since this has been exploited in the wild.

## Latest updates
- Oct 28, 2026: SignalWire publishes the critical api chat proto advisory (CVE-2026-116779, CVSS 9.8, exploitation observed in the wild) plus critical mod_xml_rpc WebSocket (CVE-2026-116785) and ICE MESSAGE-INTEGRITY (CVE-2026-116790) advisories.
- Oct 26, 2026: SignalWire publishes a first batch of FreeSWITCH advisories: pre-auth overflows in mod_xml_rpc, MSRP, mod_rtmp and SDP a=crypto parsing, fixed in 1.11.2.
- Aug 28, 2026: FreeSWITCH 1.11.3 ships as an important release with critical security fixes; Enable Security reports servers being taken over in the wild through the api-chat path, including a compromised FusionPBX box.
- Aug 9, 2026: SignalWire releases FreeSWITCH 1.11.2, which fixes most of the memory-safety and protocol bugs later published as advisories in October.

## Advisories
- [GHSA-mg63-h38w-8p9p: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands (CVE-2026-116779)](https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p) (signalwire/freeswitch)
- [GHSA-jj89-q47c-gh94: Pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame length handling (CVE-2026-116785)](https://github.com/signalwire/freeswitch/security/advisories/GHSA-jj89-q47c-gh94) (signalwire/freeswitch)
- [GHSA-rc25-33hp-6mv2: Inbound ICE connectivity checks accepted without verifying STUN MESSAGE-INTEGRITY (CVE-2026-116790)](https://github.com/signalwire/freeswitch/security/advisories/GHSA-rc25-33hp-6mv2) (signalwire/freeswitch)
- [GHSA-xjxm-9qx6-w3fj: Channel-variable injection via SIP REFER leads to command execution in mod_sofia (CVE-2026-116786)](https://github.com/signalwire/freeswitch/security/advisories/GHSA-xjxm-9qx6-w3fj) (signalwire/freeswitch)
- [FreeSWITCH security advisories](https://github.com/signalwire/freeswitch/security/advisories) (signalwire/freeswitch)
- [FreeSWITCH v1.11.3 release](https://github.com/signalwire/freeswitch/releases/tag/v1.11.3) (signalwire/freeswitch)

## Write-ups & news
- [FreeSWITCH RCE in the wild, coturn advisories verified, Hacker Summer Camp](https://www.enablesecurity.com/newsletter/2026-08-rtcsec-news/)
- [Kamailio advisory gap, WeChat zero-click worm, Switchvox exploited (FreeSWITCH api-chat: registered users can exploit it too)](https://www.enablesecurity.com/newsletter/2026-09-rtcsec-news/)

---
Machine-readable: https://pwn.watch/i/freeswitch-api-chat-rce-cve-2026-116779.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.