# CVE-2026-116786: FreeSWITCH command injection via SIP REFER URI parameters

Source: https://junglewise.ai/threats/cve-2026-116786-freeswitch-is-a-software-defined-telecom-stack-enabling-the  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-11-05  
License: CC BY 4.0 with a link back

CVE-2026-116786 · Severity: high · CVSS 8.8 · Published 2026-11-05

FreeSWITCH is a software-based telephone system that handles voice calls over IP networks. An authenticated SIP user can exploit a vulnerability in the REFER request handler to inject arbitrary system commands that execute with FreeSWITCH's privileges, potentially compromising the entire phone system and underlying server.

Technologies: [SignalWire FreeSWITCH](https://junglewise.ai/threats/technologies/freeswitch). Vendors: [SignalWire](https://junglewise.ai/threats/vendors/signalwire).

## Quick answers

**Is CVE-2026-116786 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116786 being exploited in the wild.

**How severe is CVE-2026-116786?** High severity, with a CVSS score of 8.8, published 5 November 2026.

**Which products and versions are affected?** SignalWire FreeSWITCH before 1.11.2.

**Is there a fix for CVE-2026-116786?** Yes: fixed in FreeSWITCH 1.11.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116786 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-116786?** Check whether you run SignalWire FreeSWITCH at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in FreeSWITCH 1.11.2

## Technical details

The sofia_handle_sip_i_refer() function incorrectly parses attacker-controlled Refer-To URI parameters by inserting them into a comma-delimited variable block, allowing variable injection through comma characters. An authenticated caller on a bridged call can inject an execute_on_originate variable to invoke the system dialplan application and execute OS commands before the call is answered. The fix isolates sip_invite_params in the originate event's ovars structure to prevent comma-based parsing attacks.

## Affected products

- SignalWire FreeSWITCH before 1.11.2

## Timeline

- 2026-11-05: disclosed

## References

- [https://github.com/signalwire/freeswitch/commit/fbac12b451a146fdac5104d25d337145be989e84](https://github.com/signalwire/freeswitch/commit/fbac12b451a146fdac5104d25d337145be989e84)
- [https://github.com/signalwire/freeswitch/releases/tag/v1.11.2](https://github.com/signalwire/freeswitch/releases/tag/v1.11.2)

## Related threats

- [FreeSWITCH ICE integrity validation bypass](https://junglewise.ai/threats/cve-2026-116790-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH DTLS fingerprint validation bypass in server role](https://junglewise.ai/threats/cve-2026-116789-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH integer underflow in XML decode](https://junglewise.ai/threats/cve-2026-116788-freeswitch-is-an-open-source-software-telecommunications)
- [FreeSWITCH mod_event_socket denial of service via Content-Length](https://junglewise.ai/threats/cve-2026-116787-freeswitch-is-a-software-defined-telecom-stack-enabling-the)
- [FreeSWITCH WebSocket frame length heap overflow](https://junglewise.ai/threats/cve-2026-116785-freeswitch-is-a-software-defined-telecom-stack-enabling-the)