---
title: Tip: if your PBX doesn't use SIP chat, turn it off. enable-chat=false on every FreeSWITCH profile closes the actively exploited CVE-2026-116779 path even before you upgrade | ctxsec
url: https://ctxsec.com/items/tip-freeswitch-enable-chat-false-unused-profiles
description: ""
status: "guidance (based on SignalWire advisory GHSA-mg63-h38w-8p9p)"
published: 2026-10-29
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-freeswitch-enable-chat-false-unused-profiles.md)

guidance (based on SignalWire advisory GHSA-mg63-h38w-8p9p)

2026-10-29

### Tip: if your PBX doesn't use SIP chat, turn it off. enable-chat=false on every FreeSWITCH profile closes the actively exploited CVE-2026-116779 path even before you upgrade

Most voice deployments never use inbound SIP MESSAGE, but stock FreeSWITCH accepts it on both the internal and external profiles. Steps: (1) in each Sofia profile, set `<param name="enable-chat" value="false"/>` unless you have a real chat use, then rescan or restart the profile; (2) delete the vanilla `default` and Skinny example directory users, which have no password; (3) set `disable_system_api_commands=true` as extra hardening (it does not close this bug alone); (4) upgrade to 1.11.3, which keeps the `api` chat route off by default; (5) alert on any inbound MESSAGE to a user beginning `api+`.

Sources: [SignalWire/FreeSWITCH advisory GHSA-mg63-h38w-8p9p: inbound SIP MESSAGE can select the api chat proto and run FreeSWITCH API commands (CVE-2026-116779, Oct 28)](https://github.com/signalwire/freeswitch/security/advisories/GHSA-mg63-h38w-8p9p)