CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog on 9 November 2026 as 'SignalWire FreeSwitch Code Injection Vulnerability', saying it permits configuration and credential disclosure, arbitrary call control and command execution; the US federal due date is 12 November 2026 and known ransomware campaign use is Unknown. (source: CISA KEV)

FreeSWITCH advisory GHSA-mg63-h38w-8p9p (published 28 October 2026, rated Critical, CVSS 3 9.8) says sofia_presence_handle_sip_i_message() lets the To user of an inbound SIP MESSAGE select a chat proto, and mod_dptools registers an 'api' chat interface that passes its address to switch_api_execute(), so a peer that can deliver one MESSAGE to a SIP profile chooses which FreeSWITCH API command runs.

The advisory says impact is command execution with the privileges of the FreeSWITCH process (arbitrary OS commands, disclosure of configuration and credentials, full call control), that inline Lua is a second sink where mod_lua is loaded as in stock configuration, and that exploitation of this path has been observed in the wild. Any profile that accepts inbound MESSAGE is in scope; chat handling is on by default and stock conf/vanilla leaves it on for internal and external profiles; the inbound ACL does not cover MESSAGE.

Where MESSAGE authentication is enforced, any one account on the profile is enough, and installations still carrying the stock conf/vanilla default directory user (no password or a1-hash) need no account. Affected versions are 1.11.2 and earlier; fixed in 1.11.3, which adds a per-profile enable-chat-api-proto parameter that is off unless set. Workaround: set enable-chat=false on every profile that does not need inbound SIP chat; the advisory says auth-messages alone and disable_system_api_commands=true do not close the path. (source: FreeSWITCH advisory GHSA-mg63-h38w-8p9p)