SignalWire published three security advisories on October 28, 2026 for FreeSWITCH, the open-source software that runs phone and video calling systems at many businesses. The worst of the three, CVE-2026-116779, carries a CVSS score of 9.8 and lets a single registered SIP account run operating-system commands on the server through an ordinary chat message. SignalWire says attackers are already exploiting it.
The flaw sits in the built-in 'api' chat interface. A peer that gets one SIP MESSAGE accepted can select that interface and make the server execute FreeSWITCH API commands, including OS-level commands. According to the advisory, MESSAGE authentication alone does not stop it, because any single registered account can still trigger the flaw. FreeSWITCH 1.11.2 and earlier are affected.
This matters now because the exploitation is confirmed rather than theoretical. SignalWire's advisory, filed as GitHub advisory GHSA-mg63-h38w-8p9p, states that exploitation has been observed in the wild. Teams running FreeSWITCH for voice over IP, contact centers, or video conferencing have a server that an attacker can take over with one message, and patching does not undo a compromise that already happened. Operators need to check exposed servers for unexpected commands or changes.
What the Three Advisories Cover
CVE-2026-116779 is fixed in FreeSWITCH 1.11.3. That release moves the 'api' chat feature behind a new setting, enable-chat-api-proto, which is off by default. Where an upgrade cannot happen right away, SignalWire suggests setting enable-chat=false on profiles that do not need inbound SIP chat.
The same day, SignalWire published two more critical advisories, both fixed in 1.11.2. CVE-2026-116785 is a pre-authentication heap out-of-bounds write in mod_xml_rpc WebSocket frame handling, rated 9.1. CVE-2026-116790 covers inbound ICE connectivity checks accepted without verifying STUN MESSAGE-INTEGRITY, also rated 9.1. Moving to 1.11.3 covers all three.
It is not clear that every operator will patch quickly. FreeSWITCH is widely embedded in telecom and contact-center stacks, and many deployments are maintained by small teams that do not track advisories daily. The realistic risk is a slow, uneven patch cycle across a large installed base, similar to what happens with other open-source infrastructure software.
Who Is Affected and How to Respond
Affected versions are SignalWire FreeSWITCH 1.11.2 and earlier for CVE-2026-116779, and 1.11.1 and earlier for the other two. Anyone running an unpatched instance that accepts SIP MESSAGE traffic is in scope, including systems behind a firewall if any registered account can reach them.
The recommended action is to upgrade to 1.11.3 immediately. If that is not possible, disable inbound SIP chat on profiles that do not need it, and treat any server that was exposed before patching as potentially compromised. That means reviewing logs for unexpected API or OS commands, checking for new accounts or configuration changes, and rotating credentials.
CISA has not yet added these CVEs to its Known Exploited Vulnerabilities catalog as of this writing, but the SignalWire advisory itself confirms in-the-wild exploitation. Organizations that follow KEV-driven patching should not wait for the catalog entry before acting, because the exploitation evidence already exists.
Security teams should also check whether FreeSWITCH is running as a component inside another product. Many telephony platforms embed it, and operators may not know they are running an affected version. Inventory tools that scan for installed packages or container images can surface hidden instances.
Wider Context for VoIP Security
Voice infrastructure has become a more common target in recent years. Attackers use compromised PBX and softswitch systems for toll fraud, call pumping, and as a foothold into corporate networks. A flaw that turns a chat message into remote code execution on a telephony server is exactly the kind of entry point that fraud operators look for.
The practical takeaway for security teams is to treat telephony servers like any other internet-facing application server: inventory them, patch them on the same cycle as web servers, and monitor them for unexpected process spawns. The Reuters technology desk has covered how VoIP and collaboration platforms have become part of the standard attack surface.
Monitoring should focus on child processes spawned by the FreeSWITCH process, unexpected outbound connections from telephony hosts, and changes to dialplan or configuration files. These indicators are not specific to this CVE, but they are the kinds of traces a successful exploitation would leave behind.
What to Watch Next
SignalWire has not published a full list of indicators of compromise for the exploitation it has observed, so defenders are working from the advisory text alone. Watch for a follow-up advisory or a KEV catalog entry that would confirm wider exploitation and possibly provide detection guidance.
In the meantime, the safest assumption is that any exposed FreeSWITCH instance running 1.11.2 or earlier has already been probed. Operators who cannot patch this week should at minimum set enable-chat=false and restrict SIP MESSAGE handling to trusted peers.
For related coverage, see our cybersecurity desk.
Detection and Response Playbook
Defenders without a confirmed compromise should still assume exposure and work through a short checklist. First, identify every FreeSWITCH instance in the environment, including ones embedded in third-party products. Second, upgrade each to 1.11.3 or apply the chat-disable workaround. Third, review SIP MESSAGE logs for unusual api commands or OS-level strings. Fourth, check for new user accounts, modified dialplans, and unexpected outbound connections. Fifth, rotate any credentials stored on or accessible from those servers.
Teams that do find signs of compromise should isolate the host before attempting cleanup. A telephony server that has been taken over can be used for toll fraud within hours, and attackers often install persistent access mechanisms that survive a simple patch. Rebuilding from a known-good image is safer than trying to clean in place.
Operators should also notify their carriers and upstream providers if they suspect abuse, since toll fraud charges can accumulate quickly on compromised systems.
Defenders should also keep an eye on SignalWire release notes for any follow-up patches. The bottom line is straightforward: upgrade to 1.11.3, check your logs, and do not assume that a telephony server is too obscure to be a target. The attackers already have a working exploit, and the fix is a single version bump.