cve.bz

CVE-2026-116779

9.8 criticalKEVEPSS 2.2%Fix available

Critical (9.8) in SignalWire FreeSwitch. In CISA KEV since 2026-11-09. EPSS 2.2% estimated probability of exploitation activity in the next 30 days.

On this page
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
2.2% estimated probability of exploitation activity in the next 30 days; 82nd percentile. Scored 2026-11-10. A forecast for this CVE across the internet, not for your own systems.
CISA KEV
listed 2026-11-09, due 2026-11-12
CISA's assessment (SSVC)
Exploitation: active · Automatable: yes · Technical impact: total, assessed 2026-11-06. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
CWEs
CWE-77 Improper Neutralization of Special Elements used in a Command
CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
CWE-749 Exposed Dangerous Method or Function
OWASP Top 10
A01:2025 Broken Access Control, A05:2025 Injection
Published
Modified
Assigned by
GitHub_M (CNA)
NVD analysis
Analyzed
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-116779 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-116779?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-116779?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-116779 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Affected

Versions

From the NVD's CPE matches.

ProductAffected
freeswitch:freeswitchbefore 1.11.3

Attack patterns (CAPEC)

  • CAPEC-500 WebView Injection
  • CAPEC-6 Argument Injection Likelihood: High · Severity: High
  • CAPEC-15 Command Delimiters Likelihood: High · Severity: High
  • CAPEC-43 Exploiting Multiple Input Interpretation Layers Likelihood: Medium · Severity: High
  • CAPEC-88 OS Command Injection Likelihood: High · Severity: High
  • CAPEC-108 Command Line Execution through SQL Injection Likelihood: Low · Severity: Very High
  • CAPEC-40 Manipulating Writeable Terminal Devices Likelihood: High · Severity: Very High
  • CAPEC-75 Manipulating Writeable Configuration Files Likelihood: High · Severity: Very High
  • CAPEC-76 Manipulating Web Input to File System Calls Likelihood: High · Severity: Very High
  • CAPEC-136 LDAP Injection Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits. More on the page of CWE-77.

References

Check your stackJSON