PT-2026-132064
CVE-2026-116779
·
Published
2026-10-29
·
Updated
2026-10-30
Description by
Score
N/A
Not availableNo severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
Name of the Vulnerable Software and Affected Versions
FreeSWITCH versions prior to 1.11.3
Description
An issue exists where an accepted SIP MESSAGE (a text note sent through the phone system) can be used to execute FreeSWITCH API commands, including operating system commands. This occurs because default configurations leave inbound chat enabled in both profiles, and the inbound Access Control List (ACL) does not cover the MESSAGE method. Exploitation of this flaw has been observed in the wild.
Recommendations
Upgrade to version 1.11.3.
As a temporary mitigation, set
<param name="enable-chat" value="false"/> on every profile that does not require inbound chat.
Set disable system api commands=true to limit the impact.
Remove directory users who do not have a password or a1-hash.
Restrict which entities are permitted to send SIP MESSAGE requests. Found an issue in the description? Have something to add? Feel free to write us 👾