Sangoma Switchvox Attack Exploits CVE-2026-9586 to Attempt Reverse Shells

A Sangoma Switchvox attack is actively exploiting CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Switchvox SMB Edition. The flaw can allow a remote attacker to reach operating-system command execution.

The vulnerability affects the unauthenticated /pa HTTP endpoint. Horizon3 observed valid exploitation attempts on August 30, 2026. The observed payload attempted to establish a reverse shell before collecting information about running processes.

Sangoma addressed the vulnerability in Switchvox 8.4.0.2, released on July 14, 2026. Therefore, organizations running affected Switchvox installations should prioritize the update. They should also investigate systems exposed before patching for evidence of exploitation.

Sangoma Switchvox CVE-2026-9586 at a glance

What Is CVE-2026-9586 in Sangoma Switchvox?

CVE-2026-9586 is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition. It affects the /pa HTTP endpoint and can allow a remote attacker to execute operating-system commands through crafted XML input.

The vulnerability is particularly significant because exploitation requires neither authentication nor user interaction. As a result, vulnerable Switchvox systems reachable from untrusted networks can face remote exploitation attempts.

How the Switchvox /pa Endpoint Turns SQL Injection Into RCE

The distinctive mechanism behind the Sangoma Switchvox attack starts with an unauthenticated XML request reaching the underlying PostgreSQL database.

Switchvox exposes an unauthenticated /pa HTTP endpoint for functionality associated with supported phones. Horizon3 traced requests to this endpoint through the PhoneAppsHandler.pm handler.

The vulnerable processing flow works as follows:

1. The /pa endpoint receives the HTTP request body.
2. Switchvox verifies that the body begins with <PolycomIPPhone>.
3. The application parses the supplied XML.
4. It extracts the attacker-controlled PhoneIP value.
5. The application concatenates that value directly into an SQL query without parameterization.
6. The resulting query executes against PostgreSQL.

Critically, Horizon3 reported that the database query executes as a PostgreSQL superuser.

As a result, exploitation can move beyond database manipulation. A crafted query can use PostgreSQL functionality to execute commands on the underlying operating system.

Therefore, CVE-2026-9586 is not simply a database confidentiality issue. An unauthenticated network request can cross the database boundary and reach operating-system command execution.

Attackers Are Exploiting CVE-2026-9586 Against Switchvox Honeypots

The Switchvox vulnerability is no longer only a proof-of-concept risk.

Horizon3 and Defused Cyber deployed internet-facing Switchvox honeypots in May 2026 to watch for exploitation. On August 30, 2026, those systems recorded valid exploitation attempts.

The activity originated from 176.65.148.184.

The first observed payload used Netcat to connect to 176.65.148.184 on port 39323 and piped data from that connection into sh, providing a mechanism for remote command execution.

Next, a command gathered information about running processes. It decoded a Base64-encoded shell instruction and extracted information about the top process. Then, it used curl to send the resulting information to a remote server.

Horizon3 reported that the same source rapidly targeted multiple honeypots.

However, the available research does not establish broader post-exploitation activity such as credential theft, persistence or lateral movement. These remain possible consequences of server compromise, not confirmed outcomes of the observed activity.

Why Internet-Exposed Switchvox Systems Face Higher Exploitation Risk

The Switchvox exploit requires no authenticated account or user interaction.

Therefore, vulnerable installations reachable from untrusted networks are particularly important to identify. An attacker capable of reaching the vulnerable HTTP endpoint can attempt exploitation remotely.

Horizon3 reported approximately 4,000 internet-visible Switchvox devices in Shodan when it published its research. In addition, the researchers observed rapid targeting across multiple honeypots. They said this activity suggested widespread scanning or exploitation attempts against exposed systems.

For enterprise VoIP security, this exposure deserves attention because Switchvox can form part of business-critical communications infrastructure. Successful exploitation can provide command execution within an environment connected to corporate networks.

However, the confirmed activity does not establish that attackers moved from Switchvox into adjacent systems. Organizations should investigate exposed systems rather than assume that patching removes evidence of an earlier compromise.

How to Check Switchvox for CVE-2026-9586 Exploitation

Organizations running vulnerable Switchvox installations should first determine whether their systems were accessible from untrusted networks.

Where administrators have SSH access, Horizon3 recommends inspecting:

/var/log/switchvox/db-quirks.log

The log can contain evidence of SQL statements associated with exploitation attempts.

In addition, security teams should review available network telemetry for:

• 176.65.148.184
• TCP port 39323
• Unexpected outbound connections from Switchvox systems
• Unusual curl activity associated with the appliance
• Unexpected Netcat-related activity

The IP address is an indicator from the activity Horizon3 observed. However, its absence does not prove that another source did not target the system.

Finally, teams should preserve relevant logs before remediation when they suspect compromise.

Patch Switchvox to Version 8.4.0.2 or Later

Immediately upgrade affected Switchvox installations to version 8.4.0.2 or later to remediate CVE-2026-9586.

Sangoma released Switchvox 8.4.0.2 on July 14, 2026, with CVE-2026-9586 listed among the resolved security issues. Because public sources differ on the scope of earlier affected versions, organizations running older Switchvox releases should upgrade rather than assume they are unaffected.

Administrators should also reduce unnecessary external exposure to Switchvox services.

Patching closes the vulnerable code path. However, an update cannot establish whether exploitation occurred before remediation. Therefore, organizations with previously exposed systems should also review relevant logs and network activity.

Where Hexnode Fits After a Sangoma Switchvox Attack

Hexnode does not replace the Switchvox update or directly remediate CVE-2026-9586. Its role is to strengthen and investigate supported endpoints surrounding the affected communications environment.

Investigate Downstream Windows and macOS Endpoint Activity with Hexnode XDR

If an investigation finds suspicious activity on Windows or macOS endpoints surrounding the affected communications environment, Hexnode XDR can provide visibility to support further investigation.

Security teams can use endpoint and threat context to investigate suspicious activity and understand whether signs of compromise extend beyond the Switchvox system. This helps teams assess activity on Windows and macOS environments while investigating the broader scope of an incident.

Hexnode XDR does not detect or patch CVE-2026-9586 on the Switchvox appliance. Its role in this incident is to support investigation of suspicious activity on surrounding Windows and macOS endpoints if evidence suggests the attack extended beyond Switchvox.

Featured resource

Introduction to Hexnode XDR

Learn how Hexnode XDR brings threat visibility, investigation, and endpoint response together to help security teams investigate suspicious activity and respond to endpoint threats.

Download the Presentation

Keep VoIP Administration Endpoints Governed with Hexnode UEM

Administrator workstations are another relevant control point.

Hexnode UEM can apply device-management and compliance policies to supported endpoints used for administrative tasks. For example, organizations can maintain requirements around OS posture, encryption, password policies and application compliance.

These controls do not prevent exploitation of the Switchvox /pa endpoint. Instead, they strengthen the management endpoints administrators use to access enterprise infrastructure.

Therefore, organizations should separate these responsibilities. Switchvox must be patched through Sangoma’s supported update process, while endpoint controls govern the systems surrounding its administration and investigation.

Enterprise Response Checklist for the Sangoma Switchvox Attack

Organizations using Sangoma Switchvox should treat CVE-2026-9586 as an active-exploitation issue rather than a theoretical vulnerability.

Prioritize these steps:

• Inventory exposed Switchvox systems. Identify affected installations and determine which were internet-accessible.
• Patch vulnerable installations. Upgrade affected systems to Switchvox 8.4.0.2 or later.
• Preserve relevant evidence. Retain available logs before making investigative changes where compromise is suspected.
• Review Switchvox logs. Examine db-quirks.log for suspicious SQL activity and related artifacts.
• Hunt for published indicators. Review available telemetry for the observed IP address, port and unexpected outbound connections.
• Investigate command execution. Determine whether suspicious commands executed before the system was patched.
• Examine connected endpoints when warranted. Investigate surrounding systems if evidence suggests activity extended beyond Switchvox.
• Reduce unnecessary exposure. Restrict external access to Switchvox services where business requirements permit.

This sequence separates immediate remediation from investigation. Patching addresses the vulnerable software, while incident-response activities help determine whether attackers exploited it earlier.

Closing the Switchvox /pa Attack Path

The Sangoma Switchvox attack demonstrates how one attacker-controlled XML value can cross several security boundaries.

An unauthenticated request reaches the /pa endpoint. Switchvox then extracts the attacker-controlled PhoneIP value and inserts it into an unparameterized PostgreSQL query. As a result, the SQL injection can reach operating-system command execution.

Attackers have already attempted to use this path to establish reverse shells and collect process information.

Therefore, enterprises running Switchvox should prioritize version 8.4.0.2 or later. They should also review the published indicators and investigate vulnerable systems exposed before patching.