External risk intelligence

FreeSWITCH Command Execution via SIP MESSAGE Parsing

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-116779

FreeSWITCH is a telecommunications stack commonly deployed to handle inbound SIP traffic from the public internet. As the vulnerability resides in the processing of inbound SIP MESSAGE requests, which are enabled by default on both internal and external profiles, the vulnerable service is typically exposed directly to the public-facing edge of a network infrastructure.

OS Command Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in FreeSWITCH, a software-defined telecommunications stack. The issue allows unauthorized parties to execute arbitrary commands with elevated privileges by sending specially crafted SIP messages, potentially leading to system compromise and data exposure. Exploitation has been observed in the wild, underscoring the immediate relevance of this threat.

Attackers can run FreeSWITCH commands remotely.
This impacts telecommunication systems and their data.
Confirm relevance and exposure to potential compromise.

Attack Path

How an attacker could exploit the issue

An attacker can begin by sending a specially crafted SIP MESSAGE to a FreeSWITCH system. If the system accepts this message, the attacker can then trigger a vulnerability in how the system processes the message's recipient information. This processing flaw allows the attacker to execute commands on the FreeSWITCH server with the privileges of the running daemon, potentially leading to system compromise.

Vulnerable to network-based attacks.
Triggered by processing inbound SIP MESSAGE.
Leads to command execution and data disclosure.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker to execute arbitrary commands with the privileges of the FreeSWITCH daemon. This could occur when an inbound SIP MESSAGE request is sent to a FreeSWITCH system that has chat enabled on its internal or external profiles, or when authenticated profiles are used. Even stock directory users without password material could potentially bypass authentication barriers in certain configurations.

System commands execution
Inbound SIP MESSAGE requests
Arbitrary command execution

Operational Fix

Recommended remediation, mitigation, and detection steps

For this critical vulnerability in FreeSWITCH, telecommunications and platform engineering teams are likely responsible for the impacted systems, with security teams needing to coordinate the response. The immediate first step is to identify all FreeSWITCH deployments, confirm their exposure and criticality, and then plan remediation based on the observed exploitation in the wild.

Telephony and platform engineering own the issue.
Verify external reachability and profile configurations.
Plan risk-based remediation with vendor coordination.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is FreeSWITCH?

FreeSWITCH is an open-source software stack used to build telephony applications like VoIP switches, PBXs, and conferencing systems. It replaces traditional hardware telecom switches, allowing organizations to manage voice and messaging traffic on standard servers.

What does CVE-2026-116779 mean for system security?

This is a Command Injection vulnerability, categorized as CWE-78. It means the software fails to properly filter input when handling specific SIP messages, inadvertently allowing an attacker to run unauthorized system-level commands as if they were the FreeSWITCH daemon itself.

How is this vulnerability triggered?

An attacker triggers this by sending a malformed SIP MESSAGE containing a plus sign in the recipient field. This does not happen if the FreeSWITCH configuration has the inbound chat feature disabled on all internal and external profiles.

Do I need to worry about this if my server is internal?

According to Halo Surface Signal, this vulnerability is most critical for systems facing the public internet. However, since the chat feature is often enabled by default, even internal profiles could be used as an entry point if an attacker gains access to your local network.

When should I take action against CVE-2026-116779?

You should prioritize this immediately. Start by auditing your current FreeSWITCH version; if you are running anything earlier than 1.11.3, you are affected. Update to version 1.11.3 or later as soon as possible to receive the security patch.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.