> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# FreeSWITCH flaw CVE-2026-116779 is exploited: update to 1.11.3
- URL: https://stackurity.ai/blog/freeswitch-cve-2026-116779-exploited-sip-message-command-execution/
- Published: 2026-11-11T02:05:05.000Z
- Updated: 2026-11-11T02:05:05.000Z
- Description: CISA lists FreeSWITCH flaw CVE-2026-116779 as exploited. A crafted SIP message can run commands. See who is in scope and how to update to 1.11.3.
- Author: Stackurity Research Team
- Tags: Actively Exploited, News

**TL;DR:** CISA now lists CVE-2026-116779 in SignalWire FreeSWITCH as exploited. A crafted SIP message can run commands on the server, and FreeSWITCH 1.11.3 fixes it.

## What happened

CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities catalogue on November 9, 2026 and set a due date of November 12, 2026\. NVD says that before 1.11.3, the part of FreeSWITCH that handles an inbound SIP MESSAGE trusted a field in the address and could be steered into running FreeSWITCH API commands, including ones that reach the operating system, with the privileges of the FreeSWITCH service.

NVD adds that the default setup accepts these messages, that one signed-in account on a profile is enough, and that attacks have been seen in the wild. It lists a CVSS v3.1 score of 9.8\. The result can be disclosure of configuration and credentials, control of calls and command execution.

## Am I affected?

You are in scope if you run FreeSWITCH earlier than 1.11.3, whether it handles a contact centre, a voice gateway or a SIP trunk. Check one machine by hand:

```
freeswitch -version
dpkg -l 'freeswitch*'
rpm -qa 'freeswitch*'
```

If it is older than 1.11.3, update to 1.11.3 or later from your package source or rebuild your image, then restart the service. Until you have done it, limit who can reach the SIP ports, review accounts that do not need a password and look for calls or configuration changes you did not make. Because exploitation is seen, treat stored credentials on an exposed server as possibly disclosed.

## How to check with Stackurity

Stackurity matches installed packages on supported Linux distributions, and the images of running Docker containers when the agent runs with the docker option, against advisories and the CISA catalogue every hour. It can then check again after the upgrade and record whether the issue is gone. A FreeSWITCH built from source or copied into an application outside a package manager is not covered, and neither is network appliance firmware, so confirm those versions by hand or with the vendor. Read the [verification guide](https://stackurity.ai/docs/verification) for how the recheck works, or [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=actively-exploited&utm%5Fcontent=freeswitch-cve-2026-116779-exploited-sip-message-command-execution).

Sources: [CISA Known Exploited Vulnerabilities catalogue](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search%5Fapi%5Ffulltext=CVE-2026-116779) and [NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-116779).