CVE-2026-116779 (CVSS 9.8): FreeSWITCH SIP Command Injection Actively Exploited — Patch Before CISA’s November 12 Deadline

If your organisation runs a call centre, enterprise PBX, or WebRTC gateway built on FreeSWITCH, today’s date — November 12, 2026 — is your hard deadline. CISA added CVE-2026-116779, a 9.8-severity command-injection flaw in SignalWire FreeSWITCH, to its Known Exploited Vulnerabilities (KEV) catalog on November 9, 2026, with a federal remediation deadline of today. Active exploitation was confirmed in the wild before the advisory even landed. If your FreeSWITCH deployment is still on version 1.11.2 or earlier, an unauthenticated attacker on your network can run arbitrary operating-system commands on your telephony server right now.

What Is FreeSWITCH and Why Should Every IT Leader Pay Attention?

FreeSWITCH is an open-source telephony platform maintained by SignalWire. It underpins a staggering share of enterprise voice infrastructure worldwide — from BPO call centres in India’s tier-1 cities to unified communications deployments in banking, insurance, and government. If you run Asterisk you’re familiar with the category; FreeSWITCH is its feature-rich cousin that handles WebRTC, SIP trunking, and IVR workflows at scale.

India’s outsourcing economy alone runs thousands of FreeSWITCH installations. Add enterprise PBX deployments across BFSI, healthcare, and manufacturing, and you have an enormous attack surface. What makes this vulnerability especially dangerous is that FreeSWITCH’s SIP port (typically UDP/TCP 5060, TLS 5061) is routinely exposed to the internet for inbound calls — meaning the attacker doesn’t need to be inside your network to reach it.

Inside the Flaw: How CVE-2026-116779 Works

The vulnerability lives in FreeSWITCH’s SIP MESSAGE handler — the component that processes inbound text messages in the SIP protocol (think of it as SMS over VoIP). The root cause is deceptively simple: a portion of the recipient field in a SIP MESSAGE is read by the server as the name of a chat protocol. When an attacker sets that field to api, FreeSWITCH dutifully routes the message body to its own API dispatcher, which then executes whatever command string the attacker supplied — with the full privileges of the FreeSWITCH server process.

In practice, this means an attacker who can reach port 5060 can:

• Execute arbitrary shell commands on the host
• Dump the FreeSWITCH configuration, including SIP credentials and trunk passwords
• Redirect, record, or drop active phone calls
• Use the compromised server as a pivot point into the internal network
• Install persistent backdoors or ransomware

SignalWire published advisory GHSA-mg63-h38w-8p9p on October 28, 2026, noting exploitation in the wild. NVD scored it on November 5, 2026. The fix ships in FreeSWITCH 1.11.3; version 1.11.2 introduced the previous hardening patches but does not close CVE-2026-116779.

A related flaw, CVE-2026-116786 (CVSS 8.8), affects the SIP REFER handler and also ships in the default configuration. While not yet confirmed as actively exploited, SignalWire urges patching both simultaneously since they share the same attack surface.

CISA’s November 9 KEV Alert: Four Critical Flaws, One Shared Deadline

CVE-2026-116779 was not patched in isolation. CISA’s November 9 KEV update bundled four actively exploited vulnerabilities, all demanding federal remediation by today:

CVE	Product	CVSS	Impact
CVE-2026-116779	SignalWire FreeSWITCH ≤1.11.2	9.8	SIP command injection → RCE
CVE-2026-102895	GPUStack ≤0.5	9.8	Auth bypass → unauthenticated admin access
CVE-2026-123158	OpenSSH (Alpine Linux)	8.1	Authentication bypass
CVE-2026-14996	IBM Aspera Faspex	8.2	File transfer service compromise

While the GPUStack, OpenSSH, and IBM Aspera flaws affect different technology stacks, the FreeSWITCH vulnerability is unique in its breadth — telephony infrastructure rarely gets the same patch urgency as web servers or endpoints, yet it carries call recordings, authentication flows, and direct network access.

The Indian Enterprise Angle: Why This Matters Here

India is home to the world’s largest BPO ecosystem. FreeSWITCH powers the dialers, IVR platforms, and SIP trunking gateways at thousands of contact centres across Gurugram, Noida, Bengaluru, Hyderabad, and Chennai. Many of these deployments are internet-facing by design — inbound SIP trunks terminate on FreeSWITCH boxes exposed to the PSTN gateway’s IP ranges, which are well-known and easily spoofed.

Beyond BPOs, enterprise IT teams in BFSI and healthcare regularly deploy FreeSWITCH for internal unified communications. In a zero-trust context, a compromised telephony server is a goldmine: it has access to internal LDAP/Active Directory for directory lookups, it bridges VLAN boundaries to reach desk phones, and it stores call recordings that may include OTP readbacks, voice authentication data, and sensitive conversations.

As someone who has deployed and hardened VoIP infrastructure across multi-site enterprises in Delhi NCR, I’ve seen how telephony boxes are often the last devices to receive patches — treated as appliances rather than servers. That mindset is exactly what this threat actor is counting on.

What You Should Do Right Now — Sanjay’s Defence Playbook

1. Identify all FreeSWITCH instances immediately. Run a network sweep for open UDP/TCP 5060 and 5061 ports. FreeSWITCH version strings are often exposed in SIP INVITE responses — an attacker can enumerate these passively. So can you.
2. Upgrade to FreeSWITCH 1.11.3 today. This is not optional. The release notes confirm CVE-2026-116779 and CVE-2026-116786 are both patched. Post-upgrade, review the new security options — some hardening settings ship disabled and must be enabled explicitly in vars.xml.
3. Restrict inbound SIP access to known IP ranges. If you receive SIP trunks from specific carrier IPs, enforce this at your firewall or FortiGate. Never expose FreeSWITCH’s control ports to the open internet. Apply strict ingress ACLs and validate SIP source addresses. See how I structure this in the context of a zero-trust campus deployment.
4. Audit SIP MESSAGE logs for api chat protocol references. Check your FreeSWITCH event socket logs and CDR for unusual MESSAGE transactions — especially any with a “proto” value of api or unusual recipient strings. Consider this a potential indicator of compromise.
5. Disable SIP chat handling if unused. If your FreeSWITCH deployment handles only voice calls and does not use SIP messaging, disable the MESSAGE handler in your SIP profile (sip_i_message). This eliminates the attack surface entirely.
6. Apply defence-in-depth around your PBX. Place FreeSWITCH behind a session border controller (SBC) or application-aware next-gen firewall with SIP deep inspection. This won’t fix the vulnerability, but it limits what an attacker can reach post-compromise. After my recent write-up on Fortinet emergency patches, several clients asked how this applies to their VoIP perimeter — the answer is the same: segment, inspect, and monitor.
7. Check for signs of compromise. Look for unexpected processes spawned by the FreeSWITCH user account, new cron jobs, modified configuration files, and outbound connections to unfamiliar IPs. If you find any, treat the host as compromised and isolate before further analysis.

Frequently Asked Questions

Does this affect Asterisk or other open-source PBX platforms?

No. CVE-2026-116779 is specific to SignalWire FreeSWITCH’s SIP MESSAGE handler. Asterisk, Kamailio, OpenSIPS, and other platforms have different codebases and are not affected by this particular flaw. However, all VoIP infrastructure should be treated as high-value targets warranting regular patching and strict network segmentation.

We use a hosted/cloud FreeSWITCH service. Are we still at risk?

Contact your hosted provider immediately and ask for confirmation that they have upgraded to 1.11.3 and applied the post-upgrade hardening steps. Responsible providers should have already acted, but verify — don’t assume. If your provider cannot confirm the patch status within 24 hours, escalate or consider interim mitigations such as disabling SIP MESSAGE handling at their layer.

What evidence would I see in logs if we were already exploited?

Key indicators include: unusual SIP MESSAGE transactions in the event socket log with a chat-proto or recipient value of api; unexpected process executions under the freeswitch service account (check auth.log and syslog); new files or scripts in /tmp or the FreeSWITCH run directory; and outbound network connections from the PBX host to external IPs on non-standard ports. Any of these warrant immediate incident response.

Is the CISA November 12 deadline binding outside the United States?

CISA’s BOD 22-01 binding deadline applies to US federal civilian agencies. It carries no direct regulatory weight in India. However, CISA KEV entries are widely used by Indian CERT-In, enterprise CISOs, and financial regulators as a trusted indicator of real-world exploitation priority. If a vulnerability is on the KEV list, it has confirmed exploitation evidence — that matters everywhere, not just in Washington.

---

CVE-2026-116779 is a stark reminder that telephony infrastructure deserves the same patching discipline as your web servers and endpoints. A single exploited PBX box can expose call recordings, internal credentials, and a pivot point deeper into your network. The fix is available. The deadline is today. Don’t let your phone system be the door attackers walk through.

If you’re unsure about your VoIP security posture — whether you’re running FreeSWITCH, Asterisk, or a commercial telephony stack — I offer hands-on security assessments covering your full communications infrastructure. Contact me today for a no-obligation consultation and let’s make sure your voice infrastructure isn’t your weakest link.