Phone systems running the open-source FreeSWITCH platform are under active attack through a critical flaw that lets an intruder run commands on the server with a single crafted message. The flaw, tracked as CVE-2026-116779, is scored 9.8 out of 10, and the US cybersecurity agency CISA has set today, 12 November, as the deadline for federal agencies to fix it.

FreeSWITCH is the software behind many business phone systems, call centres and public-sector switchboards. The flaw sits in how it handles an incoming SIP MESSAGE, the short text message used between phone systems. When a message arrives, FreeSWITCH splits the recipient address at a plus sign and treats the first part as the name of a chat handler. An attacker who names the “api” handler can reach the function that runs FreeSWITCH commands, including commands that reach the operating system itself, with the privileges of the server process.

What an attacker can do

According to CISA, the flaw permits configuration and credential disclosure, arbitrary control of calls and command execution. In practice that means an attacker could read stored credentials, listen in on or redirect calls, and run their own commands on the machine. SignalWire, which maintains FreeSWITCH, says exploitation of this path has been observed in the wild, although it has not named victims or given details of the attacks.

The danger is widened by the software’s default settings. Chat handling is switched on by default in the stock profiles, so many installations are exposed without any change by their owners. Where message authentication is enforced, any single account on the profile is enough to send the malicious message, and installations that still carry the stock default user with no password can be reached with no account at all.

Why phone servers are a target

Phone servers make an attractive target because they sit on the edge of a network, reachable from the internet, and they hold credentials for making calls and connecting to other systems. A compromised switch can be used to run up call charges, to harvest the credentials that let an attacker into the wider network, or as a quiet foothold from which to move deeper. FreeSWITCH is widely used by companies, schools and public bodies, so a single flaw in a default setting can put many organisations at risk at once.

CISA only adds a flaw to its Known Exploited Vulnerabilities catalogue when it has evidence of attacks in the wild, and the catalogue is the agency’s must-fix list for federal systems. The FreeSWITCH flaw joined the catalogue on 9 November alongside flaws in GPUStack, OpenSSH and IBM Aspera Faspex, all with the same 12 November deadline. The short three-day window reflects how quickly the agency expects the flaw to be used.

Who is affected and what to do

All versions up to and including 1.11.2 are affected, and the fix is in version 1.11.3, released after SignalWire published its advisory on 28 October. CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 9 November, and federal civilian agencies must apply the fix by 12 November under the agency’s binding patching directive. Private operators are not bound by that deadline, but the same risk applies to them.

Administrators who cannot upgrade immediately should switch off chat handling on every profile that does not need inbound SIP chat, by setting enable-chat to false. They should also remove any directory user with no password, and review logs for SIP MESSAGE requests whose recipient names a handler before a plus sign. A second independent report confirms the same advisory, score, fix version and deadline.