CISA adds GPUStack, FreeSWITCH, OpenSSH, and Faspex flaws to KEV
Three flaws have confirmed exploitation; GPUStack and FreeSWITCH score 9.8 and allow admin or code execution.
82
CVE-2026-116779
Arbitrary command execution in FreeSWITCH sofia_presence_handle_sip_i_message()
CISA: SignalWire FreeSwitch Code Injection Vulnerability
- CVSS 3.1
- 9.8 critical
- EPSS
- 2%p82
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
FreeSWITCH sofia_presence_handle_sip_i_message() splits the To user on a plus sign and runs API commands via switch_api_execute() when a SIP MESSAGE is accepted. Inbound chat on stock profiles with any authenticated account triggers this. Attackers gain daemon privileges for arbitrary commands, config/credential disclosure, and call control. FreeSWITCH users are affected.
What to do: Upgrade FreeSWITCH to 1.11.3.
| Product | Affected | Fixed in |
|---|---|---|
| FreeSWITCH | prior to 1.11.3 | 1.11.3 |
Estimated exposure
nicheNo basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to 1.11.3, sofia_presence_handle_sip_i_message() split the To user of an inbound SIP MESSAGE on a plus sign and treated the left side as a chat protocol selector. Selecting the api chat proto reached switch_api_execute(), allowing a peer whose MESSAGE was accepted to run FreeSWITCH API commands, including operating-system command sinks, with the daemon's privileges. Inbound chat is enabled on the stock internal and external profiles, and any authenticated profile account is sufficient; stock directory users without password material can also remove that barrier in affected configurations. The flaw permits configuration and credential disclosure, arbitrary call control, and command execution, and exploitation has been observed in the wild. This issue is fixed in version 1.11.3.
KEVCISA Known Exploited Vulnerability
- Affected
- SignalWire FreeSwitch
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- freeswitch
- Products
- freeswitch
- Weakness
- CWE-77, CWE-78, CWE-749
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the news
5 storiesCISA says IBM Faspex and FreeSWITCH flaws are exploited in attacks
Agencies must patch CVE-2026-123218 and CVE-2026-116779 within three days; GPUStack and SSHole are also listed as exploited.
82
CISA adds exploited OpenSSH, GPUStack, FreeSWITCH, and IBM flaws to KEV
FCEB agencies must apply fixes by November 12; SSHole activity includes miners, metadata queries, and a Python C2 agent.
82
CISA adds four exploited vulnerabilities to the KEV catalog
The additions cover GPUStack, FreeSWITCH, OpenSSH, and Aspera Faspex; federal agencies must prioritize exposed assets that yield full control.
82
CISA adds SignalWire FreeSwitch code injection to KEV (CVE-2026-116779)
The flaw can expose configuration and credentials, control calls, and execute commands; action is due November 12.
76