FreeSWITCH command injection exploited in the wild (CVE-2026-116779) [PoC]

Actively exploited in the wild - CVE-2026-116779 is a critical command injection flaw in FreeSWITCH before 1.11.3 that lets a peer who can send an inbound SIP MESSAGE execute FreeSWITCH API commands, including operating-system command sinks, with the daemon’s privileges. Patched in FreeSWITCH 1.11.3 - update immediately.

Overview

FreeSWITCH is an open-source software-defined telecom stack used to run voice and messaging services on commodity hardware. The flaw lives in sofia_presence_handle_sip_i_message(), which processes inbound SIP MESSAGE requests. The function split the To user portion of the message on a plus sign and treated the left side as a chat protocol selector. When that selector was set to the api chat proto, the input reached switch_api_execute(). A peer whose MESSAGE was accepted could therefore run FreeSWITCH API commands, including sinks that reach the operating system, under the daemon’s privileges.

Inbound chat is enabled on the stock internal and external profiles, so the exposure is broad out of the box. Any authenticated profile account is sufficient to trigger the path. In affected configurations, stock directory users that carry no password material can also remove that barrier, lowering the practical skill required to exploit it.

Impact

Successful exploitation hands the attacker the privileges of the FreeSWITCH process. That means configuration and credential disclosure, arbitrary call control, and command execution on the host. Call control abuse can redirect, record, or drop voice traffic, while credential disclosure can expose SIP accounts, trunks, and upstream provider secrets. Command execution turns a telecom service into a foothold for lateral movement across the network. With a CVSS score of 9.8 and no user interaction required, the severity matches the consequences.

Remediation and Mitigation

Upgrade to FreeSWITCH 1.11.3 or later, which fixes the issue. If you cannot patch immediately, take these steps:

• Restrict who can send SIP MESSAGE to the SOFIA profiles, for example by IP allowlisting your trusted peers at the network edge.
• Disable inbound chat on the internal and external profiles where your deployment does not need it.
• Audit the directory for stock accounts that have no password material and remove or harden them.
• Review FreeSWITCH logs for MESSAGE requests whose To user contains a plus sign followed by api, and check for unexpected API invocations.
• Rotate SIP credentials and any secrets visible to the FreeSWITCH process if you suspect prior compromise.

Security Insight

This bug is a parser confusion that escalates into an execution primitive: a delimiter meant to select a chat protocol instead ends up selecting the API surface. It echoes a recurring pattern in telecom software, where text-based protocol handling and powerful management interfaces sit close together, so a small parsing assumption becomes remote code execution. The fact that stock profiles ship with inbound chat enabled widens the blast radius well beyond tuned deployments, and the presence of this CVE on CISA KEV signals that attackers already map these softswitches as high-value targets. Operators should treat management interfaces on telecom stacks as internet-facing attack surface, not internal plumbing.

For related incident tracking, see breach reports and security news.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs