FreeSWITCH phone systems: one SIP chat message can run commands on the server. Upgrade to 1.11.3 before Thursday

FreeSWITCH, the open-source telephony engine under many hosted and on-premises phone systems, has a bug that lets a single SIP chat message run commands on the server. The project says attackers are already doing it, and CISA added it to its exploited list on Monday with a Thursday, November 12 deadline for federal agencies.

Many businesses run FreeSWITCH without knowing it, inside a PBX product or a provider’s platform. The fix is version 1.11.3.

A text message to your phone switch should not be able to run shell commands. On FreeSWITCH 1.11.2 and older it can. Upgrade to 1.11.3.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

One SIP message can run commands on FreeSWITCH

CVE-2026-116779 sits in how FreeSWITCH handles an inbound SIP MESSAGE. The advisory GHSA-mg63-h38w-8p9p explains that the code splits the recipient name on a plus sign and treats the left half as a chat protocol. Address a message to “api+…” and it reaches the FreeSWITCH API dispatcher, which runs the command named in it, including ones that execute operating system commands.

The advisory says “exploitation of this path has been observed in the wild.” CISA listed it on November 9 and flagged it for forensic triage, meaning agencies should check for compromise, not just patch.

• Affected: FreeSWITCH 1.11.2 and earlier. Fixed: 1.11.3, which adds a per-profile enable-chat-api-proto setting that is off by default.
• Default exposure: inbound chat is on in the stock internal and external SIP profiles.
• What it takes: any one account on the profile (an extension, a handset or a trunk peer). Installs that still carry the sample directory user with no password need no account at all.
• CVSS 9.8 (GitHub CNA).

Phone systems built on FreeSWITCH 1.11.2 or older

Code execution on a phone switch gives an attacker the SIP and trunk credentials, full call control and a foothold inside the network. Call control alone is enough for toll fraud: expensive international calls billed to your trunks, usually overnight or over a weekend.

The prerequisite is low. Registering a single handset is enough, and many switches accept SIP from the internet so remote workers and carriers can connect.

Upgrade to FreeSWITCH 1.11.3 before Thursday

• Find out whether your phone system runs FreeSWITCH. If a provider or reseller runs it, ask them in writing whether they are on 1.11.3.
• Upgrade to FreeSWITCH 1.11.3 or later and leave enable-chat-api-proto off unless you know you need it.
• Until you can upgrade, set enable-chat=false on every SIP profile that does not need inbound chat. The advisory says tightening the inbound ACL and turning on auth-messages do not close the path.
• Remove any directory user that has no password or a1-hash, such as the stock default user from the vanilla configuration.
• Set disable_system_api_commands=true as an extra layer. The advisory notes it removes the system command but not the route itself.

Details

• CVE-2026-116779 (GHSA-mg63-h38w-8p9p): sofia_presence_handle_sip_i_message() lets an inbound MESSAGE select the api chat proto and reach switch_api_execute(). CWE-77, CWE-78, CWE-749. CVSS 9.8.
• Fixed: FreeSWITCH 1.11.3 (new enable-chat-api-proto parameter, off by default; a disallowed selector gets a 403 and is logged with the source and requested command).
• KEV: added November 9, 2026; federal due date November 12, 2026; forensic triage flagged.
• Second route: where mod_lua is loaded (stock build), inline Lua is another way to run code.

Hunt / verify

• Search SIP logs for inbound MESSAGE requests whose To user starts with “api+” or contains a plus-sign selector.
• After upgrading, watch for the new 403 log lines, which record the source address and the command it asked for.
• Review call detail records for international or premium-rate calls at odd hours since late October.
• Rotate SIP extension, trunk and FreeSWITCH event socket passwords, and check the host for new cron jobs or unknown processes.

Source: FreeSWITCH advisory GHSA-mg63-h38w-8p9p; CISA KEV alert, November 9

Sources

• FreeSWITCH: Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands (GHSA-mg63-h38w-8p9p)
• FreeSWITCH releases on GitHub
• FreeSWITCH pull request 3135: add enable-chat-api-proto
• CISA: CISA Adds Four Known Exploited Vulnerabilities to Catalog (November 9, 2026)
• Zerohunt: FreeSWITCH CVE-2026-116779, a SIP message that runs OS commands
• CVE.org: CVE-2026-116779
• NVD: CVE-2026-116779

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].