Critical, CVSS 3.1 9.8In CISA KEVExploited in the wild (advisory)FreeSWITCH

Is your FreeSWITCH server still exposed to CVE-2026-116779?

The official advisory for CVE-2026-116779 says an inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands. It is scored CVSS 3.1 9.8 Critical, and the advisory says exploitation of this path has been observed in the wild. The fix is FreeSWITCH 1.11.3, released on 28 August 2026, two months before the 28 October advisory. It is in CISA KEV. Patch now.

In CISA KEV. Advisory: exploitation observed in the wild. Patch to 1.11.3

The official advisory (published 28 October 2026 at 16:46 GMT) says: 'Exploitation of this path has been observed in the wild.' CISA added CVE-2026-116779 to the Known Exploited Vulnerabilities catalogue on 9 November 2026, with a due date of 12 November 2026. That due date binds US federal agencies only. Our advice, for everyone, is to patch to 1.11.3 now. CISA also flags forensic triage as Yes on this KEV entry. Builds labelled 1.11.3-dev from 9 to 26 August 2026 are not the fix.

By Simon Phillips, CTO. Reviewed by Oliver Legg, Head of SOC and IR. Last updated 10 November 2026, 22:41 GMT.

Check Exposure How to Hunt

At a Glance

Based on GitHub advisory GHSA-mg63-h38w-8p9p, the FreeSWITCH 1.11.3 release, and CISA KEV catalogue 2026.11.10, rechecked at 22:27 GMT on 10 November 2026. Last updated 10 November 2026, 22:41 GMT.

Severity

Critical, CVSS 3.1 9.8

The official advisory and CVE record list CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, score 9.8. CWE-77, CWE-78 and CWE-749.

Status

Exploited; in CISA KEV

The advisory says exploitation of this path has been observed in the wild. Added to KEV on 9 November 2026, due 12 November (US federal agencies only). forensicTriage: Yes.

Affected

1.11.2 and earlier

The advisory: affected <= 1.11.2, fixed >= 1.11.3. A 1.11.3-dev build from 9 to 26 August 2026 is not proof of the fix.

Fix

FreeSWITCH 1.11.3

Released 28 August 2026. Do not present the August fix and the October advisory as the same day. Workarounds narrow the path; they are not the fix.

28 Aug 2026

FreeSWITCH 1.11.3 is released, with critical security fixes including the new per-profile enable-chat-api-proto parameter, off by default.

28 Oct 2026, 16:46 GMT

GitHub advisory GHSA-mg63-h38w-8p9p is published for CVE-2026-116779 and says exploitation of this path has been observed in the wild.

9 Nov 2026

CISA adds CVE-2026-116779 to KEV, due 12 November 2026, forensicTriage Yes. That due date binds US federal agencies only.

Now

Upgrade every FreeSWITCH host to 1.11.3 or later, and do not enable enable-chat-api-proto unless you intend to. Hunt for signs of misuse.

Affected versions and the 1.11.3-dev trap

The official advisory lists affected versions as <= 1.11.2, and the fix as >= 1.11.3. v1.11.3 was tagged on 28 August 2026. From 9 August 2026, master reported itself as 1.11.3-dev before the fix landed on 26 August, so a build labelled 1.11.3-dev is not proof that you have the fix. Our checker reports those builds as UNKNOWN.

Workarounds are not the fix

The advisory lists workarounds, and treats none of them as a replacement for 1.11.3. enable-chat=false on every profile that does not need inbound SIP chat stops the message before the proto selector is parsed. auth-messages alone is not sufficient. disable_system_api_commands=true is a vars.xml global (an X-PRE-PROCESS set), not a SIP profile parameter. It removes the system API but not the route, which still reaches other APIs, including module loading and call origination. Credited to security researchers; we do not name them.

What to Do in the Next 24 Hours

Proactive on the left. Reactive on the right. Vendor steps and our advice are labelled separately.

Proactive

Patch to 1.11.3

Vendor: upgrade to FreeSWITCH 1.11.3 or later. The 1.11.3 release notes call it an important release containing critical security fixes.
Vendor workaround (not a fix): set enable-chat=false on every profile that does not need inbound SIP chat, until you can upgrade.
Our advice: inventory every FreeSWITCH host. Treat 1.11.3-dev builds as unfixed until you confirm they are a true 1.11.3 or later release.
Our advice: do not set enable-chat-api-proto=true after you upgrade, unless you have a deliberate reason to open that route.

Reactive

Hunt and contain

Our advice: look for SIP MESSAGE requests whose To user selects the api chat proto, and for the 1.11.3 rejection log line.
Our advice: look for unexpected child processes of freeswitch, and for changes to dialplan, directory, vars.xml, SIP profiles or scripts.
Our advice: look for unexpected outbound connections from freeswitch to non-SIP ports.
Our advice: if you find signs of misuse, isolate the host, keep the logs, upgrade to 1.11.3, and rotate credentials the process could reach.

Proactive: Vendor Steps, Then Ours

The advisory and the 1.11.3 release first. CybaVerse advice is labelled separately.

Vendor 1

Upgrade to FreeSWITCH 1.11.3

Upgrade to 1.11.3 or later and restart FreeSWITCH. See the official advisory and the v1.11.3 release. 1.11.3 adds the per-profile enable-chat-api-proto parameter, which is off unless you set it. Leave it off unless you have a deliberate reason to enable it.

Vendor 2

Workarounds until you can upgrade

The advisory: enable-chat=false on every profile that does not need inbound SIP chat stops the message before the proto is parsed. auth-messages is not sufficient on its own. disable_system_api_commands=true is a global (for example in vars.xml) and does not close this path. The advisory treats none of these as a fix.

Our advice 1

Inventory and reject 1.11.3-dev as proof

Find every FreeSWITCH install, including containers and lab systems. Confirm the installed version is a released 1.11.3 or later. A 1.11.3-dev label from 9 to 26 August 2026 does not prove the fix is present.

Our advice 2

Run the checker

Use the pack checkers against your config tree and version string. They report MITIGATED only when every SIP profile has inbound chat off. Setting disable_system_api_commands never upgrades a verdict to MITIGATED.

Free Detection Pack

Built by the CybaVerse threat hunt team for businesses, internal IT teams and MSPs. Check exposure offline and hunt for signs of misuse. Everything is read-only.

Linux and macOS

check-freeswitch.sh

Read-only offline checker. It reads a FreeSWITCH config tree, an optional version string, inventory CSV or log files. It never contacts the PBX. A 1.11.3-dev build is treated as UNKNOWN, not as patched.

bash check-freeswitch.sh --conf /etc/freeswitch --version "$(freeswitch -version)" --host pbx1

bash check-freeswitch.sh --version 1.10.12-release

bash check-freeswitch.sh --csv inventory.csv

Download check-freeswitch.sh

Windows

Check-FreeSWITCH.ps1

The same checks in PowerShell 7, with identical output and exit codes. It also runs under PowerShell on Linux.

pwsh -File Check-FreeSWITCH.ps1 -Conf /etc/freeswitch -Version 1.11.2 -HostName pbx1

pwsh -File Check-FreeSWITCH.ps1 -Csv inventory.csv

Download Check-FreeSWITCH.ps1 (.zip)

Hunting queries

KQL and Sigma

6 KQL hunts for Microsoft Sentinel and Defender (Q1 syslog SIP MESSAGE to an api+ or keyword To user, plus the 1.11.3 rejection line; Q2 CommonSecurityLog SIP MESSAGE; Q3 child processes of freeswitch; Q4 config and script file changes; Q5 outbound connections from freeswitch to non-SIP ports; Q6 inventory). 5 Sigma rules cover the same ground, with Kusto conversions included. None of the KQL has been run against a live tenant yet. The advisory publishes no indicators of compromise.

Download KQL (.zip)Download Sigma (.zip)

Verdicts

PATCHEDVersion 1.11.3 or later, and no SIP or verto profile sets enable-chat-api-proto=true.
LIKELY VULNERABLEBelow 1.11.3 with inbound chat on.
UNKNOWNNo version given, a 1.11.3-dev build, no profiles found, or enable-chat set from a variable.
MITIGATEDenable-chat=false on every SIP profile. Upgrade anyway.
LOG HITOverrides the others. A rejection-only result means 1.11.3 blocked the attempt.

Exit codes

Code	Meaning
0	PATCHED
1	LIKELY VULNERABLE
2	UNKNOWN
3	MITIGATED
4	LOG HIT
5	Usage or read error

Removing passwordless users or setting disable_system_api_commands never changes the verdict to MITIGATED. The full pack zip contains 92 files.

What is in the pack

File	What it does
check-freeswitch.sh	Offline checker for Linux and macOS (bash)
Check-FreeSWITCH.ps1	The same checker in PowerShell 7
KQL (6 hunts)	Microsoft Sentinel and Defender hunts Q1 to Q6
Sigma (5 rules)	SIP, process, file and network rules, plus Kusto conversions
tests/	Fixtures and tests
README.md	Verified facts, vendor vs our advice, limits and usage

Download the Full Pack (.zip)README

Reactive: How to Hunt (Our Advice)

The official advisory publishes no indicators of compromise. The hunts below are CybaVerse advice. CybaOps can run them across your estate.

Hunt 1

SIP MESSAGE to the api chat proto

Look for inbound SIP MESSAGE requests whose To user selects the api proto (for example an api+ To user). On 1.11.3 and later, a rejected attempt is logged with a WARNING that the message was addressed to the api chat proto, with the source and the requested command. Pack hunt Q1 looks for that line as well as pre-fix keywords.

Hunt 2

Child processes and config changes

Look for shells, interpreters or downloaders spawned by freeswitch (Q3), and for unexpected changes to dialplan, directory, autoload_configs, sip_profiles, scripts or vars.xml (Q4). FreeSWITCH can legitimately run some system commands from dialplans; baseline first.

Hunt 3

Unexpected outbound traffic

Look for outbound connections from the freeswitch process to non-SIP ports (Q5). Adjust the expected SIP port list to your trunks.

If you find signs of compromise (our advice)

Isolate the FreeSWITCH host and keep its logs and a disk image.
Upgrade to 1.11.3 or later, and leave enable-chat-api-proto off.
Rotate credentials the process could reach, including SIP users, APIs and anything in the config tree.
Review recent call control, module loads and script changes.
Start incident response if the host is a production PBX or SBC.

FreeSWITCH CVE-2026-116779 FAQ

Short answers based on the official GitHub advisory, the 1.11.3 release, and CISA KEV, rechecked on 10 November 2026.

What is CVE-2026-116779?

The official advisory is titled 'Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands.' A peer that can deliver a SIP MESSAGE to a profile can select which FreeSWITCH API command the server runs. Impact includes command execution with the privileges of the FreeSWITCH process, disclosure of configuration and credentials, and full call control. The advisory is GHSA-mg63-h38w-8p9p, published on 28 October 2026 at 16:46 GMT. Credited to security researchers; we do not name them.

How severe is it, and is it exploited?

The official advisory scores it CVSS 3.1 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It says: 'Exploitation of this path has been observed in the wild.'

Is it in CISA KEV, and what does the due date mean?

Yes. CISA added CVE-2026-116779 on 9 November 2026, with a due date of 12 November 2026, known ransomware campaign use Unknown, and forensicTriage Yes. That due date binds US federal agencies only. Our advice, for everyone, is to patch to 1.11.3 now and to treat forensic triage as a serious requirement if you may have been exposed.

Which versions are affected, and when was the fix released?

Affected: 1.11.2 and earlier. Fixed: 1.11.3 and later, released on 28 August 2026, two months before the advisory. Do not present the fix and the disclosure as the same day. Builds labelled 1.11.3-dev from 9 to 26 August 2026 do not have the fix.

Is disable_system_api_commands a fix?

No. It is a vars.xml global (an X-PRE-PROCESS set), not a SIP profile parameter. The advisory says it removes the system API but not the route, which still reaches other APIs. Worth setting, but it does not close this path. The workaround that stops the route is enable-chat=false on every profile that does not need inbound chat. Upgrade to 1.11.3 anyway.

Who is this relevant to?

Anyone running FreeSWITCH, including hosted or managed PBX and SBC deployments that accept inbound SIP MESSAGE (the default posture unless a profile sets enable-chat=false).

Protect Your Voice Platform, and Your Customers'

CybaOps monitors your servers, endpoints and cloud workloads, whether that's your own business or your clients'. UK-based analysts monitor alerts 24/7, run these threat hunts and act on pre-approved response actions, and CybaOps drives remediation through to a verified fix, so proactive checks and reactive response happen in one place.

Book a CybaOps demo