CVE-2026-116779 allows a crafted SIP MESSAGE to execute FreeSWITCH API commands and has been observed in the wild. SignalWire rates the flaw Critical with a CVSS 3.1 score of 9.8, and Bitsight assigns a DVE score of 10.0/10, reflecting reported exploitation and threat actor interest. FreeSWITCH 1.11.3 contains the fix; organizations should upgrade and verify the updated service build is running in production.
CVE-2026-116779 technical details
The vulnerability relies on inbound SIP MESSAGE handling: out of the box, FreeSWITCH leaves chat processing active across stock internal and external profiles unless an administrator sets enable-chat=false. To exploit the issue, a SIP MESSAGE must reach a profile that accepts inbound messages. Where authentication is required, access to an account on that profile is sufficient. SignalWire also notes the stock vanilla directory includes users without a password or A1 hash; unless allow-empty-password is set to false for those users, they may authenticate without separate credentials. Although the CVSS vector lists “no privileges required,” reachability still depends on network configuration and whether inbound SIP MESSAGE traffic can reach a profile. SignalWire warns that FreeSWITCH inbound ACLs do not cover MESSAGE traffic, so those ACLs alone will not protect an otherwise reachable profile.
Mitigations and recommended actions
FreeSWITCH 1.11.3 fixes CVE-2026-116779 and introduces an enable-chat-api-proto setting that controls whether inbound messages can select the api chat protocol; this setting is off by default. Organizations should upgrade to 1.11.3 or later and confirm the patched build is running in production. If immediate patching is not feasible, SignalWire recommends setting enable-chat=false on every profile that does not need inbound SIP chat; this disables inbound MESSAGE handling on those profiles but requires checking for legitimate messaging use before applying the workaround. Partial defenses—such as enforcing message authentication, removing directory users without password material, or disabling system API commands—can reduce risk but do not fully remediate the flaw: authenticated accounts can still exploit it, other registered APIs remain available, and inbound ACL adjustments alone are insufficient because they do not cover MESSAGE traffic.
How Bitsight can help
Bitsight External Attack Surface Management can help security teams identify internet-facing FreeSWITCH assets and assess exposure across internal environments and third-party vendors. Bitsight’s Dynamic Vulnerability Exploit (DVE) scores provide threat context to help prioritize vulnerabilities with evidence of exploitation and heightened threat actor interest. For CVE-2026-116779, external visibility can surface instances that need review, but an external scan alone cannot verify exact build versions, profile options, or whether a SIP MESSAGE is accepted. Teams should validate those details with asset owners, review system logs and configuration, and confirm patch levels on each host.
Because inbound chat is enabled by default in stock profiles, organizations should not assume only custom setups are at risk. SignalWire reports observed exploitation, and CISA’s KEV listing increases the urgency to remediate. Upgrade to FreeSWITCH 1.11.3 or later and, in the interim, apply enable-chat=false to profiles that do not require inbound chat.
