Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform. The flaw allows remote code execution, enabling attackers to deploy reverse shells on vulnerable systems. No authentication is required to exploit the vulnerability, making it particularly dangerous for exposed deployments. The Sangoma Switchvox platform is a widely used VoIP and unified communications solution in enterprise environments. Active exploitation in the wild significantly raises the risk for organizations that have not patched their installations.
CVE-2026-9586 is an unauthenticated SQL injection vulnerability in Sangoma Switchvox's /pa HTTP endpoint. The endpoint parses XML messages containing key-value pairs. When /pa receives a request to notify another phone system (e.g., for call events), it extracts the PhoneIP field from the XML and directly concatenates its value into an unparameterized SQL query without sanitization. This allows remote attackers to exploit the injection to execute operating-system commands via a crafted XML request sent using curl. Active exploitation was observed on August 30 by Horizon3 honeypots, with a single source IP (176.65.148.184) targeting multiple systems in rapid succession. The attacker executed an initial payload, collected top process information from the Switchvox system, and transmitted the data to a remote server in base64-encoded form. The goal was to establish a reverse shell. Approximately 4,000 Switchvox devices are exposed on the internet, with most located in the United States.
1. Upgrade Sangoma Switchvox to version 8.4.0.2 or later as soon as possible. 2. Review /var/log/switchvox/db-quirks.log for suspicious SQL statements that may indicate exploitation. 3. Check for unauthorized network connections to the attacker IP 176.65.148.184, particularly on port 39323. 4. Audit internet-exposed Switchvox instances and consider restricting access to the /pa HTTP endpoint. 5. Monitor for reverse shell activity and unexpected outbound connections from Switchvox systems.
176.65.148.184 (attacker source IP), Port 39323 (attacker command-and-control port), /var/log/switchvox/db-quirks.log (log file to check for suspicious SQL statements)
