Use VoIP or a PBX phone system? It needs a patch now
Businesses that run their own phone system or PBX built on FreeSWITCH, and anyone using a hosted VoIP or contact-centre provider that runs it behind the scenes, worth checking even if you don't manage the system yourself. If your phone system is a mainstream service like Microsoft Teams Phone or a telco-branded VoIP plan, this generally isn't yours to worry about directly.
FreeSWITCH, open source software that powers many business phone systems and sits behind some providers' hosted VoIP (voice over the internet) and contact-centre platforms, has a critical flaw. Criminals are already using it: a single crafted message sent to the phone system can run commands on the underlying server, including stealing call credentials, listening in on or redirecting calls, and running other commands on the machine. On many default setups no valid login is needed. The software maker fixed this in version 1.11.3, released in August 2026.
Do this
Ask whoever manages your phone system: "Are we running FreeSWITCH, directly or through our VoIP or PBX provider, and has it been updated to version 1.11.3 or later?"
Sources: CISA KEV: FreeSWITCH flaw ↗ · FreeSWITCH security advisory ↗CVE-2026-116779 · CWE-77 · CWE-78 · CWE-749