CISA has added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog. The critical code injection flaw in SignalWire FreeSWITCH before 1.11.3 lets attackers send SIP MESSAGE requests that run FreeSWITCH API commands, including operating-system commands, with the daemon's privileges.
What Is It
FreeSWITCH is an open-source software telecom stack. In versions before 1.11.3, the sofia_presence_handle_sip_i_message() function split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. If the selector chose the api chat protocol, the request reached switch_api_execute(). Any peer whose MESSAGE was accepted could then run FreeSWITCH API commands, including commands that reach the operating system, with the daemon's privileges.
The flaw is tracked under CWE-77 (command injection), CWE-78 (OS command injection) and CWE-749 (exposed dangerous method or function).
Why It Matters
- Active exploitation confirmed: CISA added the CVE to the KEV catalog on 2026-11-09. NVD's description also says exploitation has been observed in the wild, and CISA's SSVC assessment rates it as exploitation "active," automatable "yes," and technical impact "total."
- Severity: CVSS 3.1 base score 9.8 (Critical), vector
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. - Impact: Disclosure of configuration and credentials, arbitrary call control, and command execution.
- Low barrier: Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is enough. In affected configurations, stock directory users without password material can remove even that barrier.
- Forensic triage: CISA marks this entry as requiring forensic triage. Known use in ransomware campaigns is listed as "Unknown."
What's Vulnerable
- Vendor: SignalWire
- Product: FreeSWITCH
- Affected versions: all versions before 1.11.3 (
cpe:2.3:a:freeswitch:freeswitch:*, versionEndExcluding 1.11.3)
CISA notes that the flaw affects an open-source component that other products may use, so FreeSWITCH-based products may also be exposed.
Patch Status
The issue is fixed in FreeSWITCH 1.11.3. The patch is available as a commit and pull request in the upstream repository, and the GitHub security advisory includes mitigation guidance.
CISA's required action is to apply mitigations according to vendor instructions, in line with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's Forensics Triage Requirements. Organizations should follow BOD 26-04 guidance for cloud services, or stop using the product if mitigations are unavailable. Stakeholders must also evaluate each asset's internet exposure. The federal remediation due date is 2026-11-12.