CISA Confirms Exploitation of FreeSWITCH SIP Command Execution
Tech GuruQuick Answer
Update FreeSWITCH to 1.11.3 or later. Check all SIP profiles, disable unused inbound chat, retain SIP and process logs, and investigate unauthorized calls, configuration changes and exposed credentials.
Confirm Scope And Apply The Supported Remediation
What to do now: Record FreeSWITCH versions, internal and external SIP profiles, chat requirements, accounts without passwords, loaded modules and telephony owners. FreeSWITCH 1.11.2 and earlier on SIP profiles accepting inbound MESSAGE. The project says chat is enabled by default; the ability to deliver an accepted message is required. Upgrade to 1.11.3 or later and retain the default disabled enable-chat-api-proto setting. Where inbound chat is unnecessary, set enable-chat=false on every relevant profile using the supported change procedure. Validate calls, trunks and required messaging after the update. Verify the API chat route remains disabled and review logs, call records, configuration and process activity for compromise.
Last verified: 2026-11-09 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | FreeSWITCH SIP profiles accepting inbound MESSAGE |
|---|---|
| Advisory | GHSA-mg63-h38w-8p9p |
| CVE | CVE-2026-116779 |
| CISA KEV addition and catalog release | November 9, 2026 (KEV addition); catalog released at 2026-11-09T16:16:16.4275Z. |
| Authority revision date | Original project advisory: 2026-10-28T16:46:07Z. Latest project revision: 2026-10-28T16:46:07Z. The new material development is CISA KEV inclusion. |
| Affected versions | FreeSWITCH 1.11.2 and earlier on SIP profiles accepting inbound MESSAGE. The project says chat is enabled by default; the ability to deliver an accepted message is required. |
| Fixed version | FreeSWITCH 1.11.3 or later |
| CVSS base score | 9.8 (CVSS v3.1) |
| CVSS severity | Critical |
| Exploitation status | CISA confirms exploitation through the November 9, 2026 KEV addition; the project also reports in-the-wild exploitation.; no exploitation claim is inferred. |
What Changed
CISA added this FreeSWITCH command-execution vulnerability to KEV on November 9. The project reports exploitation and explains that SIP MESSAGE routing can reach registered API commands with the privileges of the FreeSWITCH process.
What To Validate Now
- Inventory. Record FreeSWITCH versions, internal and external SIP profiles, chat requirements, accounts without passwords, loaded modules and telephony owners.
- Establish applicability. FreeSWITCH 1.11.2 and earlier on SIP profiles accepting inbound MESSAGE. The project says chat is enabled by default; the ability to deliver an accepted message is required.
- Remediate. Upgrade to 1.11.3 or later and retain the default disabled enable-chat-api-proto setting. Where inbound chat is unnecessary, set enable-chat=false on every relevant profile using the supported change procedure.
- Validate. Validate calls, trunks and required messaging after the update. Verify the API chat route remains disabled and review logs, call records, configuration and process activity for compromise.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The project states that inbound ACL tightening, auth-messages alone and disable_system_api_commands do not close the vulnerable route. Disabling chat changes service behavior; coordinate with voice operations and preserve call evidence. CISA lists November 12, 2026 as the due date and flags forensic triage. Federal readers should validate applicable directive requirements; other organizations should use their own incident and change procedures. Ransomware campaign use is listed as Unknown.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
