Reported by 7 outlets
Sangoma Switchvox RCE Flaw Actively Exploited in Wild via Unauthenticated SQL Injection
Why this score
- Breadth
- 2.00 / 2.0 · 7 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.03 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2026-9586 is an unauthenticated SQL injection in Sangoma Switchvox that ends in remote code execution, scored 9.3. The /pa endpoint, which relays call notifications to handsets, accepts an XML POST body through the POSTDATA CGI parameter, checks only that it begins with , parses it with XML::Simple::XMLin(), and concatenates the attacker-controlled PhoneIP field into a single-quoted PostgreSQL query. That query runs as the PostgreSQL superuser, so one crafted request reaches COPY ... TO PROGRAM and arbitrary operating-system commands; Horizon3 demonstrated a reverse shell from a single curl command. Horizon3 reported 12 Switchvox flaws to Sangoma on April 10, SRA independently found the same injection and published full detail on July 17, and the fix in Switchvox 8.4.0.2 shipped July 14.
The exploitation clock is what makes this story stand out: honeypots run by Horizon3 with Defused Cyber caught valid attacks on August 30, forty-seven days after the patch and six weeks after public exploit detail existed, from 176.65.148.184 across multiple honeypots in rapid succession, followed by a CISA KEV listing days later. Shodan shows roughly 4,000 internet-exposed Switchvox systems, most in the United States, and Horizon3's judgment is that most have been or will be targeted. A single source IP spraying many targets reads as scanning-driven opportunism, meaning exposure alone decides who gets hit, and the honeypot origin of the discovery implies most victims will never know on their own. A compromised PBX is also worse than a defaced web server: the box sits in the voice path, holds call detail and recordings, and superuser database execution makes the DB service account the first foothold rather than a prize won late.
Upgrade to Switchvox 8.4.0.2 or later, and treat any pre-8.4.0.2 host with injected SQL in its logs as compromised rather than merely vulnerable. Where patching must wait, block unauthenticated POSTs to /pa or restrict that endpoint to the subnets hosting notification-capable handsets, and pull any internet-facing management interface behind a VPN. Hunt on-box in /var/log/switchvox/db-quirks.log for fragments like "SELECT proposed_extension FROM auto_phone_config WHERE ip_address" or "COPY ... TO PROGRAM", plus unexpected /tmp files such as the observed 0d012120ab00297d.txt. In network telemetry, alert on connections to 176.65.148.184 or port 39323, and on curl or base64-in-command-line activity decoding to process enumeration like "top -bn1 | awk" listing PID, command, and CPU fields.
Two developments would change the assessment. A second distinct source address, or follow-on monetization such as toll fraud or ransomware staged from PBXes, would move this from lone-scanner noise to a campaign worth emergency change control. Published advisories or attacks touching the companion flaws SRA documented, CVE-2026-9585, CVE-2026-9587, and CVE-2026-9588 among the twelve reported, would widen the decision from one CVE to the entire 8.4.0.2 baseline for every Switchvox in the estate.
Timeline
-
original reporting
Sangoma Switchvox RCE Flaw Actively Exploited in Wild via Unauthenticated SQL Injection
gbhackers.com · 40d ago · September 3rd, 2026
Security researchers have reported active exploitation attempts targeting a critical vulnerability in Sangoma Switchvox, allowing unauthenticated attackers to execute code remotely via SQL injection. This vulnerability, tracked as CVE-2026-9586, affects internet-exposed Switchvox enterprise VoIP systems and was addressed in Switchvox version 8.4.0.2. Sangoma Switchvox RCE Flaw Zach Hanley, a researcher at Horizon3.ai, revealed that this […] The post Sangoma Switchvox RCE Flaw Actively Exploited in Wild via Unauthenticated SQL Injection appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from atlassian.net
Sangoma Switchvox Release Notes Version 8.4.0.2 (July 14, 2026) — vendor fix release
atlassian.net · 92d ago · July 14th, 2026
Sangoma's official Switchvox knowledge base hosts the release notes for Switchvox version 8.4.0.2, dated July 14, 2026 in the page title. This is the vendor release that patched CVE-2026-9586 and the companion flaws reported by Horizon3 and Security Risk Advisors. The July 14 fix date is independently corroborated by both the Horizon3 disclosure timeline and the SRA advisory.
-
update from sra.io
Advisory: Sangoma Switchvox SMB — Security Risk Advisors (CVE-2026-9585 through CVE-2026-9588)
sra.io · 89d ago · July 17th, 2026
Security Risk Advisors published the first public technical advisory on July 17, 2026, three days after the vendor fix, covering CVE-2026-9586 (unauthenticated SQL injection to RCE via the /pa endpoint's unsanitized PhoneIP value in PostgreSQL queries, CVSS 9.3) plus CVE-2026-9585 (reflected XSS, 8.6), CVE-2026-9587 (authenticated local file inclusion, 7.1), and CVE-2026-9588 (stored XSS, 7.0). Researcher Cameron Lischke submitted the findings to the vendor between May 11 and 26, 2026. Affected versions are Switchvox SMB 8.3 (104997) before 8.4.0.2, with upgrade to 8.4.0.2 or later as remediation.
-
update from horizon3.ai
Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586 — Horizon3
horizon3.ai · 43d ago · September 1st, 2026
Horizon3 researcher Zach Hanley published the original disclosure on September 1, 2026, a day before mainstream coverage began. The post documents the vulnerable code path in PhoneAppsHandler.pm (POSTDATA body parsed with XML::Simple::XMLin(), PhoneIP concatenated into a query executed as PostgreSQL superuser), a single-curl exploit yielding a reverse shell, and honeypot telemetry from Defused Cyber showing exploitation attempts on August 30 from 176.65.148.184, including an initial payload of nc 176.65.148.184 39323 | sh. It notes Shodan shows roughly 4,000 internet-exposed devices, most in the United States, and that exploitation evidence lands in /var/log/switchvox/db-quirks.log.
-
update from bleepingcomputer.com
Hackers exploit Sangoma Switchvox flaw to deploy reverse shells
bleepingcomputer.com · 41d ago · September 2nd, 2026
According to security researchers at Horizon3, most of the internet-exposed Switchvox systems have either already been targeted or will be soon. Switchvox is an enterprise VoIP management platform used to configure and monitor business phone systems. The vendor fixed them in Switchvox version 8.4.0.2, released on July 14. The researchers explain that the endpoint is exposed and parses an XML message containing specific key-value pairs. When /pa receives a request to notify another phone system, such as for an incoming or outgoing call event, it extracts the PhoneIP field from the XML message and directly concatenates its value into an unparameterized SQL query. The researchers demonstrated that this SQL injection can be exploited remotely to execute operating-system commands through a crafted XML request sent using the curl command. Exploit for CVE-2026-9586 Source: Horizon3 On August 30, Horizon3’s honeypots observed active exploitation on multiple systems in rapid succession from a single source IP address (176.65.148.184), with the attacker attempting to establish a reverse shell. In these attempts
-
update from cyberpress.org
Hackers Exploit Critical Sangoma Switchvox SQL Injection Flaw for Unauthenticated RCE
cyberpress.org · 40d ago · September 3rd, 2026
Researchers at Horizon3.ai said internet-facing honeypots run alongside Defused Cyber captured valid exploitation attempts on August 30, several weeks after Sangoma released security fixes for the enterprise VoIP platform. Sangoma Switchvox is an on-premises telephony management solution used by organizations to configure business phone systems, voicemail, call forwarding, device provisioning, call monitoring, and analytics. Critical Sangoma Switchvox SQL Injection Flaw The vulnerability affects an unauthenticated HTTP endpoint, /pa , which is designed to handle phone notification events for supported devices. According to Horizon3.ai , the issue exists in the Perl-based PhoneAppsHandler.pm component. The handler receives XML-formatted POST requests and extracts data from the supplied XML message. A PhoneIP parameter obtained from the request can reach a backend PostgreSQL query without proper validation or parameterization. Defused Switchvox Tripwire Tripped (Source: Horizon3.ai) The application reportedly checks only whether the submitted data begins with the expected XML element. It does not sufficiently sanitize the values contained in the XML before processing them.
-
update from securityweek.com
Sangoma Switchvox Vulnerabilities Exploited in the Wild
securityweek.com · 39d ago · September 4th, 2026
It resides in an endpoint that processes XML content, which did not perform sanitization or parameterization when concatenating the user-controlled PhoneIP value into PostgreSQL queries. “An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution,” a NIST advisory reads. On Tuesday, cybersecurity firm Horizon3 warned that threat actors had started exploiting CVE-2026-9586 in the wild and shared indicators of compromise (IoCs) to help organizations identify potential intrusions. On Wednesday, the US cybersecurity agency CISA added the security flaw to its Known Exploited Vulnerabilities ( KEV ) catalog along with six other issues, including the JFrog Artifactory bug and two SonicWall SMA1000 zero-days recently flagged as exploited. The fifth vulnerability added to CISA KEV is CVE-2026-48710, an HTTP request/response smuggling flaw in the lightweight ASGI framework Starlette that was publicly disclosed in May.