FreeSWITCH is the open-source telecom stack underneath a large share of hosted PBX, IVR and call-centre platforms. A flaw fixed in 1.11.3 let an inbound SIP message pick which of FreeSWITCH's own API commands the server would run, and the project says the flaw has been exploited in the wild.
What happened
The problem sits in the code that handles an inbound SIP MESSAGE. FreeSWITCH split the recipient field on a plus sign and treated the left-hand part as a chat protocol selector. Choosing the api protocol sent the rest of the string into switch_api_execute, the same internal function an administrator reaches through fs_cli. That let a remote peer run FreeSWITCH API commands, including the ones that shell out to the operating system, with the daemon's privileges.
Inbound chat is switched on in the stock internal and external SIP profiles. Any account the profile accepts is enough to try it, and the advisory notes that stock directory users without password material can clear that last barrier in affected configurations. The published impact covers configuration and credential disclosure, arbitrary call control and command execution. The record carries a CVSS 3.1 score of 9.8, and the fix shipped in 1.11.3 in October 2026.
CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalog on 9 November 2026, with a remediation deadline of 12 November for federal agencies. The vendor advisory states plainly that exploitation has been observed.
Who is affected
- Any FreeSWITCH installation older than 1.11.3, which includes 1.11.2 and every earlier release.
- Systems whose SIP profiles accept inbound MESSAGE, which is the default in the stock internal and external profiles.
- Hosted PBX, IVR, call-recording and call-centre platforms, especially where SIP trunks and remote extensions arrive from the internet or from third-party carriers.
What to do now
Upgrade to FreeSWITCH 1.11.3 or later, then treat the host's call and API credentials as potentially exposed if it was reachable from untrusted networks.
- Confirm the running version with fs_cli -x version before assuming a package upgrade landed.
- If you cannot patch today, block inbound MESSAGE on the internal and external profiles and restrict which peers may reach them at the firewall.
- Rotate SIP gateway, directory and database passwords, and review the dialplan and gateways for entries you did not create.
- Read the CDR for international, premium-rate or unusual outbound calls, and check the log for API commands and module loads you cannot account for.
What this means for South African businesses
Most local SMEs do not run FreeSWITCH themselves, but plenty buy voice from a reseller who does, so the question to ask your provider is concrete: which FreeSWITCH build is my PBX on. Where a switch is internet-facing for remote extensions or trunking, the exposure is real rather than theoretical, because the attack needs a SIP message and no valid account of its own. In practice a South African SME is more likely to notice this as a run of unexplained international or premium-rate calls on the bill than as an obvious intrusion.
The primary source is SignalWire's FreeSWITCH security advisory GHSA-mg63-h38w-8p9p, which the CVE record and CISA's KEV entry both reference.