FreeSWITCH inbound SIP MESSAGE can run API commands

The FreeSWITCH phone server can be taken over and hacked!

Summary

A flaw in how FreeSWITCH handles inbound SIP MESSAGE chat lets a peer whose message is accepted run FreeSWITCH API commands, including operating-system commands. Versions before 1.11.3 are affected, and exploitation has been observed in the wild.

Affected when

Inbound SIP chat (MESSAGE) enabled
Any authenticated profile account

What to do

Update FreeSWITCH to 1.11.3 or later.

Products and platforms

Windows
macOS
Linux
freeswitch

CVE IDs

CVE-2026-116779 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-05 19:30 UTC

First seen 2026-11-09 17:00 UTC