Attackers exploit FreeSWITCH chat flaw to run commands on telecom servers

What happened

Attackers are exploiting a bug in FreeSWITCH, the software telecom switch maintained by SignalWire, to run commands on the servers that host it. The problem sits in how FreeSWITCH handles incoming SIP chat messages. Part of the recipient address is read as a choice of chat protocol. One of those choices hands the message straight to FreeSWITCH's internal command interface.

As a result, a peer whose message is accepted can issue FreeSWITCH API commands, including ones that reach the operating system, with the same privileges as the FreeSWITCH service. That opens the door to reading configuration and credentials, taking over call handling, and running arbitrary commands. Inbound chat is switched on in the default internal and external profiles. Any authenticated account on a profile is enough, and in some setups the default directory users without passwords remove even that hurdle.

Who is affected

All SignalWire FreeSWITCH releases before 1.11.3 are affected. Systems using the default internal or external profiles have inbound chat enabled. Installations that still carry the stock directory users without passwords are at greater risk, because an attacker may not need valid credentials at all.

How serious is it

The flaw carries a CVSS score of 9.8, the critical range. A network attacker can reach it with little effort and no user interaction, and a successful attack gives full control over the FreeSWITCH service. CISA added it to its Known Exploited Vulnerabilities catalog on 9 November 2026 and has given federal agencies until 12 November 2026 to act.

What you should do

1. 1Update FreeSWITCH to version 1.11.3.
2. 2If you cannot update right away, apply SignalWire's published mitigations, or stop using the product until you can, in line with CISA's required action.
3. 3Check internet-facing FreeSWITCH servers for signs of compromise, since CISA's guidance calls for forensic triage on affected systems.

Quick facts