Patch alert: FreeSWITCH CVE-2026-116779. One accepted SIP MESSAGE can make the server run FreeSWITCH API commands, including OS commands. GitHub CVSS 9.8. Default configs are exposed: inbound chat is on unless a profile sets enable-chat=false, and stock vanilla leaves it on in both profiles. The inbound ACL doesn't cover MESSAGE. SignalWire says exploitation has been observed in the wild. Affected: 1.11.2 and earlier. Fixed: 1.11.3 What I'd do today: 1. Upgrade to 1.11.3 (the new enable-chat-api-proto is off by default; leave it off) 2. Until then, on every profile that doesn't need inbound chat: <param name="enable-chat" value="false"/> 3. Remove directory users with no password or a1-hash (helps, doesn't close it) 4. Set disable_system_api_commands=true (helps, doesn't close it) Quick check: fs_cli -x version grep -rn "enable-chat" /etc/freeswitch/sip_profiles/ https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p
