CVE-2026-116779CVSS 9.8Inbound MESSAGE API dispatch
A peer whose MESSAGE is accepted can execute commands with the FreeSWITCH process’s privileges.
FreeSWITCH patches exploited SIP MESSAGE command execution
FreeSWITCH confirms exploitation of a SIP MESSAGE path that selects its API command interface. Versions through 1.11.2 are affected; 1.11.3 closes the route by default. Authentication can still leave ordinary registered users able to exploit it.
- Disclosed
- Oct 28, 2026
- Public disclosure date
- Severity
- CVSS 9.8
- 1 CVE tracked here
- Splash zone
- SIP profiles accepting MESSAGE with mod_dptools loaded; stock passwordless users can remove the account prerequisite
- FreeSWITCH · SIP · RCE
- In the wild
- Yes
- SignalWire confirms exploitation of this command-execution path.
What happened
mod_dptools registers the API chat interface; inbound chat is enabled by default. Where MESSAGE authentication is enforced, one ordinary profile account suffices; stock users without passwords can permit accountless access. The fix rejects the API selector by default. No victim count or static indicators are published. L4 reflects confirmed exploitation.
What’s in the bowl
Fixed versions
| Product | Safe from | Note |
|---|---|---|
| FreeSWITCH | 1.11.3 |
Crime-scene timeline
Oct 28, 2026
Advisory confirms exploitation and publishes patched version
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.