Tip: if your PBX doesn't use SIP chat, turn it off. enable-chat=false on every FreeSWITCH profile closes the actively exploited CVE-2026-116779 path even before you upgrade

guidance (based on SignalWire advisory GHSA-mg63-h38w-8p9p)2026-10-29

Tip: if your PBX doesn't use SIP chat, turn it off. enable-chat=false on every FreeSWITCH profile closes the actively exploited CVE-2026-116779 path even before you upgrade

Most voice deployments never use inbound SIP MESSAGE, but stock FreeSWITCH accepts it on both the internal and external profiles. Steps: (1) in each Sofia profile, set <param name="enable-chat" value="false"/> unless you have a real chat use, then rescan or restart the profile; (2) delete the vanilla default and Skinny example directory users, which have no password; (3) set disable_system_api_commands=true as extra hardening (it does not close this bug alone); (4) upgrade to 1.11.3, which keeps the api chat route off by default; (5) alert on any inbound MESSAGE to a user beginning api+.

Sources: SignalWire/FreeSWITCH advisory GHSA-mg63-h38w-8p9p: inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands (CVE-2026-116779, Oct 28)