Exposed dangerous method or function in freeswitch - CVE-2026-116779
Published: November 9, 2026
Vulnerability identifier: #VU162773
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-116779
CWE-ID: CWE-749
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute arbitrary operating system commands with the privileges of the FreeSWITCH process.
The vulnerability exists due to unrestricted selection of the api chat protocol through the To user of an inbound SIP MESSAGE accepted by a chat-enabled FreeSWITCH SIP profile. An unauthenticated remote attacker can use stock passwordless directory accounts to deliver a crafted MESSAGE that invokes command-executing APIs, while profiles enforcing authentication without passwordless accounts require valid account credentials.
Affected software
freeswitch
How to mitigate CVE-2026-116779
Install security update from vendor's website.
freeswitch - update to 1.11.3