Self-Hosted Phone Systems on FreeSWITCH: Install Version 1.11.3 Now

If your business runs its own phone server, or your IT provider hosts one for you, find out whether it is built on FreeSWITCH, the open-source phone-switching software. On November 9, 2026, CISA added a FreeSWITCH flaw, CVE-2026-116779, to its Known Exploited Vulnerabilities catalog. On an unpatched server, one incoming SIP text message can make the phone server run commands.

The short version: update FreeSWITCH to version 1.11.3 or newer. Until you can, turn off inbound SIP chat (enable-chat=false) on every SIP profile that does not need it.

What the flaw does

According to the FreeSWITCH security advisory published October 28, an inbound SIP MESSAGE (the text-message feature of the SIP phone protocol) can choose which FreeSWITCH command the server runs. That can lead to running operating-system commands with the phone server's permissions, exposing configuration and passwords, and taking control of calls. The advisory rates it critical (CVSS 9.8) and says exploitation has been observed in the wild. CISA set a federal remediation due date of November 12, 2026.

Who is at risk

The advisory lists FreeSWITCH 1.11.2 and earlier as affected. Any SIP profile that accepts inbound messages is in scope, and that is the default setting. The advisory says tightening the inbound access list does not cover these messages. If message sign-in is required, any one account on that profile is enough, such as an extension, a desk phone or a trunk. Systems that still carry the sample "default" directory user from the stock configuration need no account at all.

If your phone service is fully hosted by a provider, the server is theirs to patch, but it is still worth asking whether their platform uses FreeSWITCH and whether it has been updated.

What to do this week

1. Find out what your phone system runs on. Ask your IT or VoIP provider whether FreeSWITCH is part of it and which version.
2. Install FreeSWITCH 1.11.3 or newer. The fix closes the command path on every profile by default.
3. If you cannot update yet, set enable-chat=false on every SIP profile that does not need inbound SIP chat. The advisory says this stops the attack before it starts.
4. Remove directory users with no password. The stock configuration ships two, "default" and a Skinny example. Also consider setting disable_system_api_commands=true; the advisory says it helps but does not close the hole by itself.
5. Check for misuse. Review the server for unexpected commands, new accounts, changed configuration or unusual calls, and change any SIP and admin passwords stored on it if you see signs of a break-in.

Questions to ask your IT provider

1. Does our phone system use FreeSWITCH, and is it on 1.11.3 or newer?
2. If not yet updated, has inbound SIP chat been turned off on every profile that does not need it?
3. Have directory users with no password been removed?
4. Can the phone server's SIP ports be reached from the whole internet, or only from our trunks and phones?