Sangoma Switchvox SQL Injection Under Active Exploitation

Threat actors are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in Sangoma Switchvox, an enterprise VoIP management platform. The flaw allows remote code execution without any credentials, and researchers have observed attackers deploying reverse shells against internet-exposed systems since August 30, 2026. With approximately 4,000 Switchvox instances accessible from the internet — most located in the United States — the exposure is significant. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026, with a mandatory remediation due date of September 5, 2026.

What Happened: Attackers Exploit Sangoma Switchvox Flaw to Deploy Reverse Shells

Security researchers at Horizon3 discovered CVE-2026-9586 along with 11 other vulnerabilities in Sangoma Switchvox and reported them to the vendor on April 10, 2026. Sangoma released Switchvox version 8.4.0.2 on July 14, 2026, patching all identified flaws. However, the critical SQL injection vulnerability remained exploitable on any internet-facing system that had not yet applied the update.

On August 30, 2026, Horizon3’s honeypots detected active exploitation targeting multiple Switchvox instances in rapid succession. The attack originated from a single source IP address — 176.65.148.184 — and the attacker attempted to establish a reverse shell on compromised systems. The initial payload was followed by reconnaissance activity, with the attacker collecting information about top-running processes on the Switchvox host. This data was then transmitted to a remote server in base64-encoded form.

Given the speed and coordination of the attacks across multiple honeypots from the same IP address, Horizon3 warned that most internet-exposed Switchvox instances have either already been targeted or will be soon. CISA subsequently added CVE-2026-9586 to its KEV catalog on September 2, citing active exploitation and requiring federal agencies to remediate by September 5 under BOD-26-04 guidelines.

Technical Details of the CVE-2026-9586 Sangoma Switchvox RCE Vulnerability

CVE-2026-9586 is an unauthenticated SQL injection vulnerability residing in the /pa HTTP endpoint of Sangoma Switchvox. This endpoint is exposed to the internet and processes XML messages containing key-value pairs. When the Switchvox system receives a request to notify another phone system — such as during an incoming or outgoing call event — it extracts the PhoneIP field from the XML message and directly concatenates its value into an unparameterized SQL query without sanitization.

This direct concatenation means an attacker can inject arbitrary SQL statements through a crafted XML payload sent via a simple curl command. Because the vulnerable endpoint requires no authentication, any remote attacker with network access to the Switchvox instance can exploit this flaw. Horizon3 demonstrated that the SQL injection can be chained to execute operating-system commands remotely, achieving full remote code execution on the underlying server.

The vulnerability is particularly dangerous because the /pa endpoint is designed to be internet-accessible for legitimate telephony operations. Organizations that exposed this endpoint without network-level restrictions have left their Switchvox servers directly accessible to hostile actors. The following conditions must be met for exploitation:

• Switchvox version earlier than 8.4.0.2 is running
• The /pa HTTP endpoint is accessible from the internet
• The attacker can send a crafted XML request containing a malicious PhoneIP field value

Exploitation Chain and Observed Attacker Behavior

After gaining initial access through SQL injection, the observed attacker executed an initial payload and then collected top-process information from the compromised Switchvox system. This data was base64-encoded and transmitted to a remote server. The attacker also attempted to establish a reverse shell, indicating the goal was persistent remote access rather than simple data theft.

Compromised systems may show the following indicators of compromise:

• Suspicious statements in /var/log/switchvox/db-quirks.log
• Unexpected network connections to IP address 176.65.148.184, particularly on port 39323
• New or unexpected processes spawned by the Switchvox system user

Business and Operational Impact

The active exploitation of CVE-2026-9586 poses severe risks to organizations running vulnerable Sangoma Switchvox deployments. The potential consequences extend across multiple dimensions of enterprise operations.

Scope of Exposure

• Approximately 4,000 Sangoma Switchvox instances are internet-exposed, according to Shodan scans
• Most affected devices are located within the United States, suggesting significant risk to U.S.-based enterprises
• The vulnerability requires no authentication, meaning any attacker who can reach the /pa endpoint can exploit it

Data Security and Confidentiality

• Full database access through SQL injection exposes all data stored in the Switchvox PostgreSQL database, including call records, voicemail content, extension configurations, and potentially sensitive contact information
• Reconnaissance activity observed in the attacks — gathering process lists — suggests attackers are profiling systems for further exploitation or lateral movement

Service Availability and Operational Disruption

• Successful exploitation grants attackers full remote code execution, allowing them to disable VoIP services, exfiltrate data, or use the compromised server as a pivot point for deeper network intrusion
• Organizations relying on Switchvox for business communications may experience service outages if attackers disrupt telephony operations or encrypt files

Compliance and Regulatory Implications

• CISA’s addition of CVE-2026-9586 to the KEV catalog triggers BOD-26-04 obligations for federal agencies, with remediation required by September 5, 2026
• Private sector organizations in regulated industries (healthcare, finance, government contracting) may face compliance violations if this known vulnerability is not addressed

Mitigation and Recommendations

Organizations running Sangoma Switchvox must act immediately to identify vulnerable instances and apply patches or mitigations. The following steps should be prioritized in the order listed.

Immediate Actions for Defenders

1. Upgrade Switchvox immediately — Apply Switchvox version 8.4.0.2 or later, released July 14, 2026, which patches all 12 vulnerabilities discovered by Horizon3, including CVE-2026-9586.
2. Restrict internet access to the /pa endpoint — Use firewall rules or network access controls to block external access to the vulnerable endpoint. If the endpoint must be accessible for legitimate telephony, restrict it to known trusted IP ranges only.
3. Check for signs of compromise — Review /var/log/switchvox/db-quirks.log for suspicious statements. Investigate any unexpected outbound connections, particularly to IP address 176.65.148.184 on port 39323.
4. Rotate credentials — After patching, rotate any credentials that may have been exposed or stored in plain text in configuration files accessible through the database.
5. Enable and review logging — Ensure comprehensive logging is enabled on Switchvox and actively monitor logs for the indicators of compromise listed above.

Network-Level Mitigations

If immediate patching is not feasible, network-level controls can reduce the risk of exploitation. Administrators should consider placing Switchvox behind a VPN or restricting access via IP allowlisting at the firewall level. Web application firewall rules that validate or reject requests containing SQL injection patterns in the PhoneIP field may also reduce exploit attempts, though these are not substitutes for patching.

Bottom line: CVE-2026-9586 is being actively exploited in the wild with a CISA-mandated remediation deadline of September 5, 2026. Any organization running an internet-exposed Switchvox instance on a version earlier than 8.4.0.2 should treat this as a critical, time-sensitive incident and apply the patch or network-level mitigations immediately.

Incident Summary

CVE ID / Incident:	CVE-2026-9586
Affected Systems:	Sangoma Switchvox versions earlier than 8.4.0.2; approximately 4,000 internet-exposed instances worldwide
Disclosure Date:	April 10, 2026 (reported to vendor by Horizon3); Patch released July 14, 2026; Public disclosure September 2, 2026
Patch Status:	Patch available in Switchvox version 8.4.0.2 (released July 14, 2026)
CISA KEV Status:	Added to CISA KEV catalog September 2, 2026; Due date September 5, 2026
Attacker IP Observed:	176.65.148.184 (attempts to deploy reverse shells, exfiltrate process data)

References

1. BleepingComputer, “Hackers exploit Sangoma Switchvox flaw to deploy reverse shells,” September 2, 2026, https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/ (accessed September 3, 2026)
2. Horizon3 AI, “CVE-2026-9586: Sangoma Switchvox RCE,” https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/ (accessed September 3, 2026)
3. CISA, Known Exploited Vulnerabilities Catalog, entry for Sangoma Switchvox CVE-2026-9586, added September 2, 2026, https://www.cisa.gov/known-exploited-vulnerabilities-catalog (accessed September 3, 2026)