CISA confirms a critical FreeSWITCH bug is under active attack

CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalogue on 9 November, confirming attacks already under way against FreeSWITCH, the open-source telephony engine used to build self-hosted PBX and call-centre systems.

The flaw sits in the function that handles inbound SIP MESSAGE requests. It splits the message’s To field on a plus sign and hands off to a chat handler that can run FreeSWITCH API commands, including operating-system commands, with the daemon’s privileges. SignalWire’s own advisory, published 28 October, rates it 9.8 out of 10 and lists “privileges required: none” for stock configurations; even where MESSAGE authentication is switched on, one valid account is enough to trigger it. Versions up to 1.11.2 are affected. 1.11.3 fixes it.

Why it matters: if you’re running FreeSWITCH, this is an unauthenticated route to arbitrary command execution on the host, not a theoretical one. SignalWire shipped the fix two weeks before CISA confirmed exploitation, so patch to 1.11.3 now if you haven’t. CISA’s deadline for federal agencies is 12 November, but the confirmed exploitation applies to anyone’s deployment.