Tia N.List

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2026-9586
Sangoma · Switchvox · Added 2026-09-02 · Published 2026-07-17
3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilitySangoma Switchvox SQL Injection Vulnerability
VendorSangoma
ProductSwitchvox
Date added2026-09-02
Due date2026-09-05
CISA catalogView on CISA KEV catalog
Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CWECWE-89
Descriptions

KEV: Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

NVD: An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Compliance SSVC + BOD 26-04

Automatableyes
Technical impacttotal
Exploitation statusactive
3-day qualifyingYes
Public timeline3 days + forensic
Non-public timeline3 days + forensic
Forensic (public)Required
Forensic (non-public)Required

Research metadata

Last researched2026-09-02 18:39 UTC
Component defaultyes
Sources https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/
https://github.com/advisories/GHSA-m32j-v93f-gfgc
https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html
https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/
https://www.cypro.se/2026/09/02/attackers-exploit-critical-switchvox-flaw-to-deploy-reverse-shells-without-credentials/

Hunting hypothesis agent

Hunt Switchvox /pa endpoint logs for POST with <PolycomIPPhone> XML containing SQL injection (semicolons, COPY TO PROGRAM). Check /var/log/switchvox/db-quirks.log for anomalous SQL patterns.

Research details

ComponentPhoneAppsHandler.pm /pa endpoint (tel_notify function SQL injection sink)
PreconditionsNetwork reachability to Switchvox /pa endpoint; no authentication required; affects Switchvox SMB Edition 8.3 (104997); the /pa endpoint must be exposed; attacker sends POST with XML body starting with <PolycomIPPhone> containing injected PhoneIP value; SQL injection executes as PostgreSQL superuser agent
Public PoCyes
PoC URLs https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/ Third-party repos; verify before use.
Advisoryhttps://github.com/advisories/GHSA-m32j-v93f-gfgc
Exploit notesActive exploitation observed in the wild via Defused Cyber honeypots (Aug 30, 2026). Horizon3 documented full exploit chain: POST XML with <PolycomIPPhone> to /pa, inject PhoneIP with SQL payload using PostgreSQL COPY ... TO PROGRAM for reverse shell. Attacker IP 176.65.148.184 observed. PoC shows single-curl exploitation. DB evidence in /var/log/switchvox/db-quirks.log. ~4000 internet-exposed instances per Shodan.
SummaryCVE-2026-9586 is an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 affecting the /pa endpoint (PhoneAppsHandler.pm). The PhoneIP field from <PolycomIPPhone> XML is concatenated directly into PostgreSQL queries without parameterization. Attackers execute arbitrary SQL as superuser, achieving RCE via COPY ... TO PROGRAM. Active exploitation observed since August 30, 2026, with reverse shells deployed. Fixed in Switchvox 8.4.0.2.

Tia coverage

First reported2026-07-29
First exploit report2026-09-02
Exploit report → KEV0 days before the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

active-exploitation-of-cisco-secure-firewall-management-center-vsangoma-switchvox-rce-flaw-actively-exploited-in-wild-via-unauth

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.

Source on GitHub