How to Fix CVE-2026-116779 in SignalWire FreeSwitch

The two-minute check

1. Open the server or computer that runs your phone system and look for FreeSwitch in the installed software or process list.
2. Check the version number shown in the FreeSwitch console or package manager.
3. Ask whoever set up your phone system whether it uses FreeSwitch under the hood, even if the box or brand looks different.

When you can stop reading

If nothing on your network runs SignalWire FreeSwitch, this flaw does not apply to you. You can close this tab.

What the official record says

The National Vulnerability Database (NVD) scores this flaw 9.8 out of 10, rated CRITICAL, under Common Vulnerability Scoring System (CVSS) version 3.1 (NVD). The scoring details show the attacker only needs network access to the server. No password and no click from anyone on your team is required.

The Exploit Prediction Scoring System (EPSS) puts the probability of exploitation in the next 30 days at 1.3%, which places it at the 70.6th percentile among all scored flaws (EPSS). That is a low chance of exploitation in the next 30 days, and EPSS is a forecast of near-term activity, not a measure of how severe the flaw itself is.

The vendor's own writeup explains how this gets triggered. A chat-style message sent to the server can be split in a way that reaches internal API commands, including commands that run on the underlying operating system (SignalWire advisory). This issue is fixed in version 1.11.3 (release notes).

What that means for a business like yours

This flaw sits on the internet-facing side of your phone system. A successful attack can expose call recordings and directory passwords. It can also let someone place or redirect calls through your system. Because the attacker needs no valid login and no action from your staff, patching is the most direct protection.

If your phone system handles call recordings or customer data covered by rules like the FTC Safeguards Rule or HIPAA, this exposure matters even more. Those rules expect you to protect systems that touch sensitive information.

If someone else manages your IT

If a provider handles your managed IT services, send them a short note today. Ask them to confirm whether any phone system you run uses SignalWire FreeSwitch. Ask them to patch it to version 1.11.3 or later. Ask them to confirm the patch is installed and tell you the date.

You can paste this into an email:

• "Do we run SignalWire FreeSwitch anywhere on our network?"
• "If so, please patch CVE-2026-116779 to version 1.11.3 today."
• "Please confirm once it's done and tell me the date."

If you manage it yourself

1. Open the FreeSwitch release page and confirm the fixed version is 1.11.3 (FreeSwitch release notes).
2. Read the vendor's security advisory for details on how the flaw works (SignalWire advisory).
3. Schedule a short maintenance window, since updating will briefly interrupt active calls.
4. Download and install version 1.11.3 or later on every server that runs FreeSwitch.
5. Restart the FreeSwitch service and confirm test calls connect normally.
6. Review your directory accounts and chat message settings, since the flaw is reached through those features. Tightening who holds those credentials is part of good privileged access management.

This flaw is on the CISA Known Exploited Vulnerabilities (KEV) catalog, which means attackers are already using it in real-world attacks (CISA KEV catalog). Federal agencies were given until November 12, 2026 to patch it (CISA KEV entry for this flaw). The honest answer for your business is the same one: now.

Don't just trust a progress bar. After the update finishes, open the FreeSwitch console and check the version number shown at startup. It should read 1.11.3 or higher. Compare that number against the official release page to confirm you have the fixed build (FreeSwitch release notes). If you want to see exactly what changed, the fix itself is public (the fix commit).

If you can't patch today, limit who can reach the server. Block inbound chat-style SIP MESSAGE traffic from the public internet at your firewall. This buys time, but it does not fix the flaw itself.

Review your dial-plan and remove or restrict the "api" chat protocol selector described in the advisory, if your configuration allows it. Remove any stock directory accounts that lack real passwords. None of these steps replace the patch. They only reduce the window an attacker has before you apply it.

A broader cybersecurity review can help you watch for unusual call activity while you plan the update.

Do I have to do anything if we only use a hosted or cloud phone service?

The record only names SignalWire FreeSwitch as the affected product. If your provider runs FreeSwitch behind their service, ask them directly whether they've applied the fix.

Will patching break anything?

Updating FreeSwitch will briefly interrupt active calls while the service restarts. Test a few calls afterward to confirm everything still connects and routes correctly.

How do we know if we were already attacked?

The public record doesn't describe specific detection steps. Review your call and message logs for unusual activity, and consider involving a cybersecurity team if anything looks off.

Is this tied to ransomware?

The record notes no known ransomware use so far. It is still on the CISA Known Exploited Vulnerabilities (KEV) catalog because attackers are actively using it for other purposes.

What if we're not sure whether we run FreeSwitch at all?

That uncertainty is worth resolving quickly. LayerLogix brings 20+ years of experience and 100% U.S.-based support to help you find out. Request a free IT assessment or contact us and we'll check for you.