FreeSWITCH phone systems need version 1.11.3 now — CVE-2026-116779 is being exploited

On November 9, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-116779 to its Known Exploited Vulnerabilities (KEV) catalog. It’s a code injection flaw in FreeSWITCH, the open-source telephony engine that sits underneath a number of phone systems and hosted-voice platforms. CISA’s deadline for federal agencies is November 12, 2026, which tells you how urgent it considers this.

If you run a FreeSWITCH-based phone system anywhere that can be reached from the internet, update it before you do anything else today.

What’s affected

The flaw is in how FreeSWITCH handles an inbound SIP MESSAGE, the SIP method used for short text messages. According to the National Vulnerability Database (NVD) record, which is sourced from the project’s own security advisory, versions before 1.11.3 are affected. A peer whose message is accepted can run FreeSWITCH administrative commands, including ones that reach the operating system, with the privileges of the FreeSWITCH process.

Three things make this one worse than most:

• Low barrier. The NVD entry says inbound chat is enabled on the stock internal and external profiles, and that any authenticated account on the profile is enough. It also notes that default directory users without password material can remove even that barrier in affected configurations. The CVSS v3.1 score is 9.8 out of 10 (critical), with no privileges required.
• Broad impact. The record lists configuration and credential disclosure, arbitrary call control, and command execution as outcomes. On a phone system that means exposed SIP and trunk credentials, toll fraud, and possibly a foothold on the server.
• Exploitation is confirmed. The NVD record states that exploitation has been observed in the wild, and CISA’s KEV listing is based on that kind of evidence.

CISA’s listing also flags this one for its forensic triage requirements, which is a reminder that patching alone may not be enough on an exposed system (more on that below).

Check whether you’re exposed

1. Find out whether you run FreeSWITCH at all. Many people don’t know. Some phone systems are built on FreeSWITCH (FusionPBX, for example, describes itself as an open-source phone system based on FreeSWITCH), and some hosted-voice or call-recording appliances use it internally. Ask your phone vendor or MSP directly: “Is any part of our system FreeSWITCH, and what version?” Don’t assume a product is or isn’t affected from its name.
2. Check the version. On a server you manage, the FreeSWITCH console reports its version, and your package manager or install directory will too. Anything older than 1.11.3 is affected, unless your vendor has told you in writing that it carries the fix in its own build.
3. Check whether SIP is reachable from the internet. From outside your network, or by looking at your firewall rules, see whether SIP (the standard ports are 5060 and 5061) is open to the world. Our guide to locking down an exposed on-prem PBX walks through this.

How to fix it

• Update to FreeSWITCH 1.11.3 or later. That’s the fixed version named in the NVD record. If your phone system is a packaged product, install your vendor’s update, and ask them to confirm which FreeSWITCH fix it includes. Take a snapshot or backup first, as with any PBX change.
• Shrink the exposure while you wait. If you can’t update today, restrict SIP to your known trunk provider’s addresses and your own network, and remove any port forward that exposes the phone system to everyone. Require a VPN for remote phones where you can. This reduces risk but doesn’t replace the update.
• If it was reachable and unpatched, treat it as possibly compromised. Review the server for unfamiliar processes, accounts, or scheduled tasks. Look at call detail records for international or premium-rate calls you don’t recognize, and check outbound connections for anything unexpected. Then rotate SIP extension passwords, trunk credentials, and any admin passwords stored on or used from that server. Get a second set of eyes on it before you declare it clean.
• Tell your provider if you have one. If an MSP or phone vendor manages the system, ask for the version and the date it was patched, in writing.

Patching closes the hole; it doesn’t remove anything that got in through it. If your system was internet-facing on an old version, check for signs of compromise too.

If your agency or bank has incident-reporting obligations, confirm with your compliance officer, examiner, or counsel whether a suspected compromise of the phone system triggers them.

Sources

• CISA Known Exploited Vulnerabilities catalog — lists CVE-2026-116779 (SignalWire FreeSwitch Code Injection), added November 9, 2026, due date November 12, 2026.
• NVD: CVE-2026-116779 — description (sourced from the project’s GitHub security advisory), affected versions (before 1.11.3), fixed version, CVSS 9.8, and the note that exploitation has been observed.
• FreeSWITCH security advisory GHSA-mg63-h38w-8p9p — the vendor advisory, as cited in the NVD record.
• FreeSWITCH v1.11.3 release — the fixed release, as cited in the NVD record.
• FusionPBX — describes itself as an open-source phone system based on FreeSWITCH.