CISA Adds FreeSWITCH Code Injection Vulnerability to KEV List

## Overview CISA added CVE-2026-116779 to its Known Exploited Vulnerabilities (KEV) list on November 9, 2026. This vulnerability affects FreeSwitch, a software-defined telecom stack. It allows for code injection, leading to potential configuration and credential disclosure, arbitrary call control, and command execution. ## Technical Details The vulnerability lies in the `sofia_presence_handle_sip_i_message()` function. It processes inbound SIP MESSAGE requests by splitting the "To" user on a plus sign. This allows the left side to be treated as a chat protocol selector. If the API chat protocol is selected, it can reach `switch_api_execute()`. This enables a peer whose MESSAGE is accepted to execute FreeSWITCH API commands with the daemon's privileges. The flaw is particularly concerning as inbound chat is enabled on stock internal and external profiles, and authenticated accounts can exploit this without significant barriers. ## Impact Exploitation of this vulnerability has been observed in the wild. Attackers can gain unauthorized access to system commands and sensitive information. This poses a significant risk to organizations using FreeSwitch, especially those with default configurations or weak authentication measures. ## Mitigation Defenders should upgrade to FreeSwitch version 1.11.3 or later to address this vulnerability. Organizations must also review their configurations to ensure that inbound chat features are secured. CISA's warning indicates a federal deadline of November 12 for remediation, emphasizing the urgency of addressing this issue.