CISA Adds FreeSWITCH Vulnerability to Actively Exploited Vulnerabilities List
CISA added FreeSWITCH vulnerability CVE-2026-116779 to its KEV Catalog. Operators should update to version 1.11.3 or later.
On November 9, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added FreeSWITCH CVE-2026-116779 to its Known Exploited Vulnerabilities (KEV) Catalog. The addition means that the vulnerability in SignalWire FreeSWITCH telecommunications software has been confirmed as being exploited in the wild.
This is a code injection flaw involving the processing of incoming SIP MESSAGE requests. According to the FreeSWITCH project’s security advisory, an attacker could use such a message to trigger FreeSWITCH API commands.
FreeSWITCH CVE-2026-116779: Affected Versions and Impact
FreeSWITCH versions up to and including 1.11.2 are affected. A fix is available in version 1.11.3 and later releases. Operators of PBX and VoIP systems should therefore make this update a priority.
Successful exploitation could allow commands to be executed with the privileges of the FreeSWITCH process. The vendor lists disclosure of configuration and login credentials, as well as call control, among the possible consequences. In systems handling voice communications, such access could directly affect the confidentiality and availability of telephone services.
Temporary Mitigation Is Not a Substitute for the Fix
SignalWire recommends setting enable-chat=false on SIP profiles that do not need to receive SIP chat. This measure limits the risky processing path for incoming messages.
The vendor also warns that the auth-messages and disable_system_api_commands=true settings do not, by themselves, completely eliminate the vulnerability. Operators should therefore not consider them a full substitute for moving to a fixed version.
What Is Not Yet Known
Neither CISA nor SignalWire has disclosed the extent of the observed exploitation, its targets, the perpetrators, or specific campaigns. It has also not been confirmed how many publicly accessible FreeSWITCH instances remain vulnerable.
For FreeSWITCH CVE-2026-116779, it will be important to monitor any release of technical indicators of compromise and details about the attacks. The availability of updated FreeSWITCH 1.11.3 packages in individual distributions and operator environments will also be relevant.
Sources
- CISA Known Exploited Vulnerabilities Catalog – Confirms that CVE-2026-116779 was added to KEV on November 9, 2026, and is being exploited in the wild.
- SignalWire FreeSWITCH GitHub Security Advisory GHSA-mg63-h38w-8p9p – Describes the technical cause, impact, affected versions, observed exploitation, mitigations, and fix.
- SignalWire FreeSWITCH v1.11.3 release – Confirms the release of version 1.11.3 and the addition of the `enable-chat-api-proto` parameter to block the risky path.
Verified and updated: 11/10/2026 06:21
