Threat actors are actively exploiting a critical security vulnerability in Sangoma Switchvox, an enterprise VoIP platform. The vulnerability, tracked as CVE-2026-9586, carries a CVSS score of 9.3 and affects Sangoma Switchvox SMB Edition 8.3 (build 104997). The flaw is an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary code without any credentials. Attackers are leveraging this vulnerability to deploy reverse shells on compromised systems. The unauthenticated nature of the exploit makes it particularly dangerous as no prior access or credentials are required. The critical severity and active exploitation make this a high-priority patching concern for organizations using the affected VoIP platform.
CVE-2026-9586 is a critical unauthenticated SQL injection vulnerability (CVSS 9.3) in Sangoma Switchvox SMB Edition 8.3 (build 104997). The vulnerable endpoint is /pa, which processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP parameter value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can exploit this to execute arbitrary SQL statements against the backend PostgreSQL database as the PostgreSQL superuser. Exploitation impacts include: extracting database contents, modifying user records, escalating privileges to Switchvox web administrators, exfiltrating the cookie signing key to forge authentication material for arbitrary users, and executing arbitrary code on the server including deploying reverse shells. Post-exploitation activity observed includes running Base64-encoded commands to enumerate running processes. Approximately 4,000 instances are exposed to the internet, predominantly in the U.S. Active exploitation was observed in the wild starting August 30, 2026, with multiple honeypots targeted from the same source IP in quick succession.
1. Upgrade Sangoma Switchvox to version 8.4.0.2 or later, released July 14, 2026, which contains the patch for CVE-2026-9586. 2. Review '/var/log/switchvox/db-quirks.log' for evidence of SQL injection payloads on devices with SSH access enabled. 3. Block or monitor traffic from the known attacker IP address 176.65.148.184. 4. Restrict internet exposure of Switchvox instances; apply firewall rules to limit access to the /pa endpoint from untrusted sources. 5. Monitor for reverse shell activity and anomalous Base64-encoded command execution on Switchvox servers. 6. Audit Switchvox web administrator accounts for unauthorized privilege escalation or account modifications. 7. Rotate cookie signing keys and invalidate existing sessions if compromise is suspected.
176.65.148.184, /var/log/switchvox/db-quirks.log (SQL injection payload evidence on SSH-enabled devices)
