{"slug":"freeswitch-sip-message-rce","title":"FreeSWITCH SIP MESSAGE RCE (CVE-2026-116779)","shortName":"FreeSWITCH","summary":"Developing catalog page. Inbound SIP MESSAGE handling can select the api chat proto and run FreeSWITCH API commands, including OS command execution as the FreeSWITCH process. SignalWire GHSA-mg63-h38w-8p9p (28 Oct 2026, 16:46 UTC) says this path has been observed in the wild. Affected <= 1.11.2, patched >= 1.11.3. CVSS 3.1 9.8 (GHSA). Not in CISA KEV (catalog 2026.10.28, checked 29 Oct 2026). No public PoC indexed. No CVE.org or NVD record yet as of 29 Oct 2026.","isExample":false,"draft":false,"family":"freeswitch-sip-message-rce","kind":"single-product","aliases":["CVE-2026-116779","GHSA-mg63-h38w-8p9p","FreeSWITCH SIP MESSAGE RCE"],"publishedAt":"2026-10-29","updatedAt":"2026-10-29","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-116779","cvss":{"cve":"CVE-2026-116779","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1","scorer":"cna","sourceUrl":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","sourceDate":"2026-10-28","checkedDate":"2026-10-29","dateLabel":"GHSA dated","sourceLabel":"GHSA advisory"},"epss":{"cve":"CVE-2026-116779","score":null,"percentile":null,"date":null,"sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-116779","checkedDate":"2026-10-29"},"kev":{"cve":"CVE-2026-116779","listed":false,"dateAdded":null,"dueDate":null,"catalogVersion":"2026.10.28","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-29"},"addedDate":"2026-10-29"},"priority":{"label":"act-now"},"managementSummary":{"what":"Inbound SIP MESSAGE handling in FreeSWITCH can run API commands, including OS commands as the FreeSWITCH process (CVE-2026-116779, GHSA CVSS 3.1 9.8). SignalWire says this path has been observed in the wild (28 Oct 2026). Not in CISA KEV (checked 29 Oct 2026). No public PoC indexed. No CVE.org or NVD record yet as of 29 Oct 2026.","action":"Upgrade FreeSWITCH to 1.11.3 or later. Until then, set enable-chat=false on profiles that do not need inbound SIP chat. auth-messages alone does not close the path. Hunt FreeSWITCH logs for 403s that name the source and the requested command on patched hosts."},"seenInTheWild":[{"metric":"vendor-stated","value":"Vendor advisory states this path has been observed in the wild","observer":"SignalWire / FreeSWITCH","date":"2026-10-28","method":"GHSA-mg63-h38w-8p9p Impact section, published 2026-10-28 16:46 UTC. No first calendar day of exploitation is named.","sourceUrl":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p"}],"seenInTheWildLinks":[],"whatChanged":{"date":"2026-10-29","items":[{"text":"Developing catalog page for FreeSWITCH SIP MESSAGE command execution (CVE-2026-116779). To be filled in on the next daily check.","headline":"Developing catalog page for FreeSWITCH CVE-2026-116779","section":"overview","date":"2026-10-29","kind":"page"},{"text":"SignalWire GHSA-mg63-h38w-8p9p (28 Oct 2026, 16:46 UTC) says this path has been observed in the wild. Affected <= 1.11.2, patched >= 1.11.3. Not in CISA KEV (catalog 2026.10.28, checked 29 Oct 2026). No public PoC indexed.","headline":"Vendor advisory reports in-the-wild use; patched in 1.11.3","section":"exploitation","date":"2026-10-29","sourceUrl":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","alsoSourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-10-29","kind":"page"}]},"whatTheBugIs":"CVE-2026-116779 is a developing catalog page for inbound SIP MESSAGE handling in FreeSWITCH. SignalWire published GitHub advisory GHSA-mg63-h38w-8p9p on 28 Oct 2026 at 16:46 UTC. The advisory is Critical, CVSS 3.1 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). As of 29 Oct 2026 there is no CVE.org or NVD record yet. FIRST EPSS had no score yet on that same check.\n\nAn inbound SIP MESSAGE can select the api chat proto, which runs FreeSWITCH API commands. Impact named in the advisory: command execution with the privileges of the FreeSWITCH process, including OS commands, configuration and credential disclosure, and call control. Where mod_lua is loaded, which the advisory says stock configuration does, inline Lua is a second sink. This page does not republish request examples.\n\nAffected versions: FreeSWITCH 1.11.2 and earlier. Patched versions: 1.11.3 and later. The GitHub release tag v1.11.3 was published 28 Aug 2026 at 22:27 UTC; its notes list enable-chat-api-proto for mod_sofia (and mod_verto). Default posture, per the advisory: chat is on unless a profile sets enable-chat=false, and stock conf/vanilla leaves it on for the internal and external profiles. The inbound ACL does not cover MESSAGE. MESSAGE authentication is on by default from 1.10.7, but any one registered account is enough; installs that still carry conf/vanilla/directory/default/default.xml (user id default with no password or a1-hash) need no account of their own unless allow-empty-password is false for that user. The advisory also names a second empty-password vanilla user (the Skinny example).\n\nThe fix adds per-profile enable-chat-api-proto, off unless set. A MESSAGE that selects the api proto where the parameter is off is answered 403 and logged with the source and the requested command. Comparison is case-insensitive. GHSA credits gunnlaugurmani as analyst. The advisory body also names Örn Arnarson and Gunnlaugur.\n\nExploitation status: vendor-reported in the wild (SignalWire, 28 Oct 2026). First calendar day of exploitation: not named. Not in CISA KEV (catalog 2026.10.28, released 2026-10-28T19:00:04Z, 1,762 entries, checked 29 Oct 2026). No public PoC indexed (checked 29 Oct 2026).\n\nRelated SignalWire advisories published the same day, verified and listed as related only: GHSA-xjxm-9qx6-w3fj CVE-2026-116786 (SIP REFER channel-variable injection to command execution in mod_sofia, High, CVSS 3.1 8.8, affected <= 1.11.1, patched >= 1.11.2); GHSA-mjp3-3cq2-hxj4 CVE-2026-116783 (mod_spandsp UDPTL out-of-bounds write, High, CVSS 3.1 8.2; remote code execution not demonstrated); GHSA-v7mq-h638-6fxp CVE-2026-116782 (pre-authentication invalid pointer in mod_rtmp connect handling, High, CVSS 3.1 7.5; the advisory says a stock install does not load mod_rtmp; memory disclosure and code execution not demonstrated). Those are not this CVE.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"SIP MESSAGE accepted","detail":"A profile accepts an inbound SIP MESSAGE. Default: chat is on unless enable-chat=false."},{"id":"select","label":"api chat proto selected","detail":"An inbound SIP MESSAGE can select the api chat proto."},{"id":"api","label":"API command runs","detail":"The api chat proto runs FreeSWITCH API commands. Conceptual impact class only."},{"id":"exec","label":"OS command as FreeSWITCH","detail":"The advisory: command execution with the privileges of the FreeSWITCH process. Optional second sink if mod_lua is loaded."}]},"exploitation":{"kev":{"listed":false,"date":"2026-10-28","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"Not in CISA KEV (checked 29 Oct 2026) against catalog 2026.10.28 (released 2026-10-28T19:00:04Z, 1,762 entries). CVE-2026-116779 is not listed. No CVE.org or NVD record yet as of 29 Oct 2026."},"firstSeen":{"date":"2026-10-28","source":"SignalWire GHSA-mg63-h38w-8p9p","note":"Vendor advisory published 28 Oct 2026 16:46 UTC states this path has been observed in the wild. First calendar day of exploitation: not named. The 28 Oct date is the advisory date, not a first-seen exploitation day. Not in CISA KEV (checked 29 Oct 2026).","dateLabel":"Reported"},"vendorStatements":[{"vendor":"SignalWire / FreeSWITCH","date":"2026-10-28","statement":"Inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands. … Exploitation of this path has been observed in the wild.","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","retracted":false}]},"timeline":[{"date":"2026-08-28T22:27:30Z","event":"FreeSWITCH v1.11.3 was published on GitHub. Release notes list enable-chat-api-proto for mod_sofia and mod_verto. GHSA-mg63-h38w-8p9p later names >= 1.11.3 as the patched range.","source":{"title":"FreeSWITCH v1.11.3 Release","url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.3","publisher":"SignalWire / FreeSWITCH"},"kind":"patch","key":true,"addedDate":"2026-10-29"},{"date":"2026-10-28T16:46:07Z","event":"SignalWire published GHSA-mg63-h38w-8p9p for CVE-2026-116779. Critical, CVSS 3.1 9.8. Affected <= 1.11.2. Patched >= 1.11.3. The advisory states this path has been observed in the wild.","source":{"title":"GHSA-mg63-h38w-8p9p","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","publisher":"SignalWire / FreeSWITCH"},"kind":"exploited","key":true,"addedDate":"2026-10-29"},{"date":"2026-10-28T16:46:07Z","event":"Same advisory: inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands. Workarounds: enable-chat=false; auth-messages is not enough; disable_system_api_commands=true helps but does not close the path. Fix: enable-chat-api-proto (off by default) and 403 plus a log of source and requested command.","source":{"title":"GHSA-mg63-h38w-8p9p","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","publisher":"SignalWire / FreeSWITCH"},"kind":"advisory","key":true,"addedDate":"2026-10-29"},{"date":"2026-10-28","event":"Not in CISA KEV. Catalog 2026.10.28 released 2026-10-28T19:00:04Z (1,762 entries). Rechecked 29 Oct 2026. CVE-2026-116779 is not listed.","source":{"title":"CISA Known Exploited Vulnerabilities catalog","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","publisher":"CISA"},"kind":"kev","addedDate":"2026-10-29"}],"openNotes":[{"title":"Developing catalog page","detail":"This is a short stub for the next daily check. Fill in any NVD enrichment, EPSS score, CISA KEV change, public PoC, downstream vendor statements, and extra coverage that appears after 29 Oct 2026. Do not invent those fields.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]},{"title":"No CVE.org or NVD record yet; FIRST has no EPSS score yet","detail":"NVD API 2.0 returned zero results for CVE-2026-116779 on 29 Oct 2026. The CVE.org record for that ID was reserved only, with no published details, on the same check. FIRST EPSS returned an empty data array on the same day. The 9.8 score and vector on this page are from GHSA-mg63-h38w-8p9p, not from a CVE.org or NVD metric.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116779","date":"2026-10-29","publisher":"CVE.org"},{"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116779","date":"2026-10-29","publisher":"FIRST EPSS"}]},{"title":"First calendar day of in-the-wild use is not named","detail":"The vendor advisory states this path has been observed in the wild. It does not name a first-seen calendar day, an observer other than the vendor, or a count of hosts. Independent public corroboration: not verified as of 29 Oct 2026.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]}],"defenderActions":[{"title":"Inventory FreeSWITCH versions and chat-enabled SIP profiles","detail":"Record every FreeSWITCH host and compare the version to GHSA-mg63-h38w-8p9p (affected <= 1.11.2; patched >= 1.11.3). On each SIP profile, record enable-chat and, on 1.11.3 or later, enable-chat-api-proto. Default vanilla internal and external profiles leave chat on.","priority":"now","links":[{"label":"GHSA-mg63-h38w-8p9p","href":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p"}]},{"title":"Upgrade to FreeSWITCH 1.11.3 or later","detail":"The advisory patched range is >= 1.11.3. The v1.11.3 GitHub release (28 Aug 2026) is the build that adds enable-chat-api-proto (off by default). An upgrade does not replace log review if the host accepted MESSAGE while vulnerable.","priority":"now","links":[{"label":"FreeSWITCH v1.11.3","href":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.3"}]},{"title":"If you cannot patch yet, set enable-chat=false on profiles that do not need inbound chat","detail":"The advisory: enable-chat=false stops the message before the proto selector is parsed, and disables all inbound MESSAGE chat on that profile. auth-messages alone is not sufficient. disable_system_api_commands=true removes the system API but not the route.","priority":"now","links":[{"label":"GHSA-mg63-h38w-8p9p","href":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p"}]},{"title":"Remove vanilla empty-password directory users and hunt 403 logs on patched hosts","detail":"Installs that still carry conf/vanilla/directory/default/default.xml (user default with no password or a1-hash) need no account of their own unless allow-empty-password is false. The advisory also names a Skinny example empty-password user. On 1.11.3 or later, a blocked api proto MESSAGE is answered 403 and logged with the source and the requested command.","priority":"now","links":[{"label":"GHSA-mg63-h38w-8p9p","href":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p"}]}],"detection":[{"title":"FreeSWITCH log: 403 with source and requested command (1.11.3 and later)","detail":"GHSA-mg63-h38w-8p9p: on a profile where enable-chat-api-proto is not enabled, a MESSAGE that selects the api chat proto is answered 403 and logged with the source and the requested command. This is a pointer on patched hosts, not a pre-fix signature. The advisory does not quote the exact log line. Do not invent a pattern. Absence of a 403 is no statement yet on an unpatched host.","logSource":"FreeSWITCH application log","kind":"generic","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28"},{"title":"No pre-fix vendor log signature in the sources we opened","detail":"The advisory names the 403-and-log behaviour as part of the 1.11.3 fix. It does not publish a detection signature for 1.11.2 and earlier. Treat missing logs as no statement yet, not as clearance.","logSource":"FreeSWITCH application log","kind":"generic","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28"}],"detectionLinks":[{"title":"GHSA-mg63-h38w-8p9p (403 log of source and requested command)","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","author":"SignalWire / FreeSWITCH","date":"2026-10-28","note":"Fix-time detection pointer only. No exact log line quoted. This site does not republish exploit content."}],"amIAffected":{"summary":"FreeSWITCH 1.11.2 and earlier is in the GHSA-mg63-h38w-8p9p affected range. The fix is 1.11.3 or later. Default vanilla internal and external profiles accept inbound MESSAGE unless enable-chat=false. Linux distro and appliance packages: no statement yet.","checks":[{"id":"v2s-aia-freeswitch-sip-message-rce-version-1","kind":"version","title":"Record the installed FreeSWITCH version against GHSA-mg63-h38w-8p9p","detail":"GHSA-mg63-h38w-8p9p: affected <= 1.11.2; patched >= 1.11.3. No public CLI version string was copied from the advisory in this pass. Use the product's own version display or your package manager.","command":"Record the installed FreeSWITCH version from the product's own version display or package manager and compare it to GHSA-mg63-h38w-8p9p (affected <= 1.11.2; patched >= 1.11.3).","affectedMeans":"The installed version is 1.11.2 or earlier.","fixedMeans":"The installed version is 1.11.3 or later.","notes":"This is inventory only. Do not send a SIP MESSAGE to test the path.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]},{"id":"v2s-aia-freeswitch-sip-message-rce-config-2","kind":"config","title":"Record enable-chat on each SIP profile","detail":"The advisory: chat handling is on unless a profile sets enable-chat=false, and stock conf/vanilla leaves it on for both the internal and external profiles. The inbound ACL does not cover MESSAGE.","command":"On each SIP profile, record whether enable-chat is false. If the parameter is absent, treat chat as on (advisory: default posture).","affectedMeans":"A profile on 1.11.2 or earlier does not set enable-chat=false, so inbound MESSAGE chat is accepted.","fixedMeans":"Every profile sets enable-chat=false, or the host is on 1.11.3 or later and enable-chat-api-proto is not enabled.","notes":"enable-chat=false disables all inbound MESSAGE chat on that profile, not only the api proto.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]},{"id":"v2s-aia-freeswitch-sip-message-rce-config-3","kind":"config","title":"Record vanilla empty-password directory users","detail":"The advisory: conf/vanilla/directory/default/default.xml defines user id default with no password and no a1-hash, and that user authenticates unless allow-empty-password is false. Stock vanilla also ships a Skinny example empty-password user.","command":"Search directory XML for user entries that have neither a password nor an a1-hash, including conf/vanilla/directory/default/default.xml if that file is still present.","affectedMeans":"A directory user with no password and no a1-hash is still loaded, and allow-empty-password is not false for that user.","fixedMeans":"No loaded directory user lacks both password and a1-hash, or each such user has allow-empty-password set to false.","notes":"Removing those users reduces the path to authenticated command execution when MESSAGE auth is on. It does not close the path.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]},{"id":"v2s-aia-freeswitch-sip-message-rce-config-4","kind":"config","title":"On 1.11.3 or later, record enable-chat-api-proto","detail":"The advisory: enable-chat-api-proto is off unless explicitly set. The parameter ships commented out in the vanilla profiles and the mod_sofia sample. Confirm no profile has turned it on after upgrade.","command":"On each SIP profile of a 1.11.3 or later host, record whether enable-chat-api-proto is set to a true value.","affectedMeans":"A profile on 1.11.3 or later explicitly enables enable-chat-api-proto.","fixedMeans":"No profile enables enable-chat-api-proto, which is the shipped default.","notes":"This parameter does not exist on 1.11.2 and earlier. Upgrade first.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]}],"limits":["No sourced Shodan or Censys fingerprint for this CVE. Do not invent one.","No public CLI version string was copied from GHSA-mg63-h38w-8p9p.","Linux distribution and appliance packages: no statement yet."],"sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}],"updatedAt":"2026-10-29","addedDate":"2026-10-29"},"mitigations":{"summary":"SignalWire documents workarounds: enable-chat=false on profiles that do not need inbound SIP chat; auth-messages is not sufficient on its own; disable_system_api_commands=true helps but does not close the path. The software fix is 1.11.3 or later.","items":[{"title":"Set enable-chat=false on profiles that do not need inbound SIP chat","detail":"GHSA-mg63-h38w-8p9p: enable-chat=false on every profile that does not need inbound SIP chat. This stops the message before the proto selector is parsed.","limits":"Disables all inbound MESSAGE chat delivery on that profile, not only the api proto. Not a software fix. Still upgrade to 1.11.3 or later.","verify":"Each profile that should not accept inbound chat has enable-chat=false, and FreeSWITCH has been reloaded or restarted so the profile is using that value. Re-check after the next config change.","source":{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}},{"title":"Set disable_system_api_commands=true (partial only)","detail":"GHSA-mg63-h38w-8p9p: disable_system_api_commands=true removes the system API. The advisory says this is worth setting.","limits":"Does not close the path. The route still reaches every other registered API, including module loading and call origination. Not a substitute for enable-chat=false or the 1.11.3 upgrade. auth-messages is not sufficient on its own even with empty-password users removed.","verify":"The running configuration has disable_system_api_commands=true. Confirm after reload. This check does not prove the MESSAGE path is closed.","source":{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}}],"updatedAt":"2026-10-29","addedDate":"2026-10-29"},"response":{"summary":"Upgrade to FreeSWITCH 1.11.3 or later, or set enable-chat=false until you can. If a host accepted MESSAGE while on 1.11.2 or earlier, preserve FreeSWITCH logs and treat secrets the process could reach as exposed. No sourced in-the-wild persistence list was published in the sources we opened.","containment":[{"title":"Set enable-chat=false if you cannot patch immediately","detail":"GHSA-mg63-h38w-8p9p: enable-chat=false stops the message before the proto selector is parsed. This also disables all inbound MESSAGE chat on that profile.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]},{"title":"Upgrade FreeSWITCH to 1.11.3 or later","detail":"GHSA-mg63-h38w-8p9p patched range: >= 1.11.3. The v1.11.3 release (28 Aug 2026) adds enable-chat-api-proto, off unless set. An upgrade does not replace review of logs from the vulnerable period.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.3","date":"2026-08-28","publisher":"SignalWire / FreeSWITCH"}]},{"title":"On 1.11.3 or later, review 403 logs that name a source and a requested command","detail":"The advisory: a MESSAGE that selects the api proto where enable-chat-api-proto is off is answered 403 and logged with the source and the requested command. That is a post-fix pointer. No exact log line is quoted. No sourced pre-fix persistence path was published.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]}],"rotate":[{"item":"Credentials, API keys, and secrets the FreeSWITCH process could reach","reason":"General: if command execution as the FreeSWITCH process succeeded, treat secrets on or behind that host as exposed. The advisory names configuration and credential disclosure as an impact class. No CVE-2026-116779-specific rotate list was published in the sources we opened.","generic":true,"sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]}],"evidence":[{"title":"Installed FreeSWITCH version string from before the upgrade","detail":"Preserve the version you recorded against GHSA-mg63-h38w-8p9p so you can show whether the host was 1.11.2 or earlier while MESSAGE was accepted.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]},{"title":"SIP profile and directory XML from the vulnerable period","detail":"Keep copies of profile enable-chat / enable-chat-api-proto settings and directory files, including whether default.xml or another empty-password user was loaded.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]},{"title":"FreeSWITCH logs covering the period the host accepted MESSAGE","detail":"On 1.11.3 or later, keep 403 lines that name a source and a requested command. On earlier builds the advisory names no explicit exploit log. Absence is no statement yet, not clearance.","sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"}]}],"limits":["No sourced in-the-wild persistence paths or IOCs from a source we opened.","The 403 log is a 1.11.3 fix behaviour. It is not a detector for 1.11.2 and earlier.","First calendar day of exploitation: not named. Not in CISA KEV (checked 29 Oct 2026)."],"sources":[{"url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","publisher":"SignalWire / FreeSWITCH"},{"url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.3","date":"2026-08-28","publisher":"SignalWire / FreeSWITCH"}],"updatedAt":"2026-10-29","addedDate":"2026-10-29"},"bulletins":[{"vendor":"SignalWire / FreeSWITCH","title":"GHSA-mg63-h38w-8p9p inbound SIP MESSAGE api chat proto (CVE-2026-116779)","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","cve":"CVE-2026-116779"}],"coverage":[{"title":"GHSA-mg63-h38w-8p9p Inbound SIP MESSAGE can select the api chat proto","publisher":"SignalWire / FreeSWITCH","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","date":"2026-10-28","type":"vendor","addedDate":"2026-10-29"},{"title":"FreeSWITCH v1.11.3 Release","publisher":"SignalWire / FreeSWITCH","url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.3","date":"2026-08-28","type":"vendor","addedDate":"2026-10-29"},{"title":"GHSA-xjxm-9qx6-w3fj SIP REFER channel-variable injection (related, same day)","publisher":"SignalWire / FreeSWITCH","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-xjxm-9qx6-w3fj","date":"2026-10-28","type":"vendor","addedDate":"2026-10-29"},{"title":"GHSA-mjp3-3cq2-hxj4 mod_spandsp UDPTL out-of-bounds write (related, same day)","publisher":"SignalWire / FreeSWITCH","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mjp3-3cq2-hxj4","date":"2026-10-28","type":"vendor","addedDate":"2026-10-29"},{"title":"GHSA-v7mq-h638-6fxp pre-authentication mod_rtmp pointer issue (related, same day)","publisher":"SignalWire / FreeSWITCH","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-v7mq-h638-6fxp","date":"2026-10-28","type":"vendor","addedDate":"2026-10-29"},{"title":"CISA KEV catalog JSON (CVE-2026-116779 not listed; catalog 2026.10.28)","publisher":"CISA","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2026-10-28","type":"government","addedDate":"2026-10-29"}],"posts":[],"research":[{"title":"GHSA-mg63-h38w-8p9p","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","authors":"SignalWire / FreeSWITCH (credit: gunnlaugurmani, analyst; advisory body also names Örn Arnarson and Gunnlaugur)","date":"28 Oct 2026, 16:46 UTC"},{"title":"FreeSWITCH v1.11.3 Release","url":"https://github.com/signalwire/freeswitch/releases/tag/v1.11.3","authors":"SignalWire / FreeSWITCH","date":"28 Aug 2026, 22:27 UTC"},{"title":"CISA KEV catalog JSON (CVE-2026-116779 not listed; catalog 2026.10.28)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"catalog 2026.10.28, checked 29 Oct 2026"}],"impact":{"kind":"single-product","product":"FreeSWITCH","versions":[{"version":"FreeSWITCH 1.11.2 and earlier","status":"affected","versions":">= 1.11.3","vendorStatement":{"date":"2026-10-28","url":"https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p","quote":"Affected versions … <= 1.11.2 … Patched versions … >= 1.11.3"},"addedDate":"2026-10-29"},{"version":"Linux distribution and appliance packages of FreeSWITCH","status":"no-statement-yet","versions":"Not stated","addedDate":"2026-10-29"}]},"pocs":[],"pocEmptyState":"No public PoC indexed. GitHub repository search for CVE-2026-116779 and GHSA-mg63-h38w-8p9p returned no matching repositories (checked 29 Oct 2026). The vendor advisory is not a public exploit listing.","_feed":{"page":"https://vuln2shell.com/vulns/freeswitch-sip-message-rce","json":"https://vuln2shell.com/vulns/freeswitch-sip-message-rce.json","iocsCsv":"https://vuln2shell.com/vulns/freeswitch-sip-message-rce/iocs.csv","stix":"https://vuln2shell.com/vulns/freeswitch-sip-message-rce/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"No public PoC indexed"}}}