Exploitation reportedSat, 31 Oct 2026
FreeSWITCH SIP flaw exploited: update business phone and contact center systems
FreeSWITCH confirmed exploitation of a SIP MESSAGE vulnerability that can run commands with the service’s privileges. Upgrade to 1.11.3 or later.
Article
The FreeSWITCH advisory, published October 28, 2026, rates CVE-2026-116779 9.8 under CVSS v3.1. Releases up to and including 1.11.2 are affected. The flaw is fixed in 1.11.3.
A SIP profile that accepts SIP MESSAGE can expose the vulnerable path. If message authentication is enabled, an account that can register normally is sufficient. Empty-password accounts in default settings may also let attackers proceed without credentials of their own.
- 01
Send a SIP MESSAGE
The attacker reaches a SIP profile that accepts the message.
- 02
Trigger command execution
Message handling can invoke a service API with the FreeSWITCH process’s privileges.
- 03
Affect telephony and connected systems
An attacker may reach call services, settings, credentials and dependent systems.
What to do: from the perimeter to internal systems
- 01
Inventory telephony
Identify versions and reachable SIP profiles across on-premises systems, containers and outsourced services.
See what to doResources: 1
TWISA member solutions
Inventory telephony
Identify versions and reachable SIP profiles across on-premises systems, containers and outsourced services.
- 02
Update and test calls
Install 1.11.3 or later and verify SIP messaging and call handling. Check that enable-chat-api-proto has not been re-enabled.
- 03
Reduce reachable paths
If you cannot update immediately, set enable-chat=false on profiles that do not need SIP messaging and remove empty-password accounts. Message authentication or inbound ACL changes alone do not close the vulnerability.
See what to doResources: 1
TWISA member solutions
Reduce reachable paths
If you cannot update immediately, set enable-chat=false on profiles that do not need SIP messaging and remove empty-password accounts. Message authentication or inbound ACL changes alone do not close the vulnerability.
- 04
Investigate and recover
Preserve SIP and host logs, review unusual commands and settings changes, and verify recovery from known-good configuration backups.
See what to doResources: 1
TWISA member solutions
Investigate and recover
Preserve SIP and host logs, review unusual commands and settings changes, and verify recovery from known-good configuration backups.
Map FreeSWITCH hosts, SIP profiles and their business dependencies.
Allow authorized traffic and apply controls at each layer.
- 01
SIP entry
Reachable SIP profiles
Limit exposureDisable unused messaging paths and confirm the business impact.
- 02
Telephony host
FreeSWITCH and modules
Patch and monitorVerify the running version and monitor process activity.
- 03
Credentials and recovery
Accounts and configuration backups
Reduce spilloverRemove empty passwords and protect offline configuration backups.
Feed logs and traffic data from each layer into monitoring and response.
- Monitoring and recoveryCorrelate SIP and host activity. Verify messaging, calls and service recovery after changes.
Test and verify
Use authorized asset discovery, vulnerability scanning, penetration and API testing, and attack simulation. Verify SIP configuration, segmentation and host monitoring, then retest after updates. Test any separate website and WAF path independently from SIP and host controls.
TWISA member solutions
Inventory telephony
Identify versions and reachable SIP profiles across on-premises systems, containers and outsourced services.
Reduce reachable paths
If you cannot update immediately, set enable-chat=false on profiles that do not need SIP messaging and remove empty-password accounts. Message authentication or inbound ACL changes alone do not close the vulnerability.
Investigate and recover
Preserve SIP and host logs, review unusual commands and settings changes, and verify recovery from known-good configuration backups.
Sources and further reading
Alert updated: 2026/10/31. Check the vendor’s latest guidance for product support and patch status.