{"id":1368,"date":"2026-09-03T11:50:39","date_gmt":"2026-09-03T06:20:39","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1368"},"modified":"2026-09-04T10:35:11","modified_gmt":"2026-09-04T05:05:11","slug":"sangoma-switchvox-attack-cve-2026-9586","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/sangoma-switchvox-attack-cve-2026-9586\/","title":{"rendered":"Sangoma Switchvox Attack Exploits CVE-2026-9586 to Attempt Reverse Shells"},"content":{"rendered":"

A Sangoma Switchvox attack is actively exploiting CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Switchvox SMB Edition. The flaw can allow a remote attacker to reach operating-system command execution.<\/p>\n

The vulnerability affects the unauthenticated \/pa<\/code> HTTP endpoint. Horizon3 observed valid exploitation attempts on August 30, 2026. The observed payload attempted to establish a reverse shell before collecting information about running processes.<\/p>\n

Sangoma addressed the vulnerability in Switchvox 8.4.0.2, released on July 14, 2026. Therefore, organizations running affected Switchvox installations should prioritize the update. They should also investigate systems exposed before patching for evidence of exploitation.<\/p>\n

Sangoma Switchvox CVE-2026-9586 at a glance<\/h2>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Detail<\/span><\/b>\u00a0<\/span><\/td>\nInformation<\/span><\/b>\u00a0<\/span><\/td>\n<\/tr>\n
CVE<\/span><\/b>\u00a0<\/span><\/td>\nCVE-2026-9586<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Product<\/span><\/b>\u00a0<\/span><\/td>\nSangoma Switchvox SMB Edition<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Vulnerability type<\/span><\/b>\u00a0<\/span><\/td>\nUnauthenticated SQL injection leading to remote code execution<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CWE<\/span><\/b>\u00a0<\/span><\/td>\nCWE-89<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
CVSS<\/span><\/b>\u00a0<\/span><\/td>\nCVSS v4.0: 9.3, Critical<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Attack vector<\/span><\/b>\u00a0<\/span><\/td>\nNetwork<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Authentication required<\/span><\/b>\u00a0<\/span><\/td>\nNo<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
User interaction<\/span><\/b>\u00a0<\/span><\/td>\nNo<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Exploitation status<\/span><\/b>\u00a0<\/span><\/td>\nActive exploitation\u00a0observed\u00a0by Horizon3<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Fixed version<\/span><\/b>\u00a0<\/span><\/td>\nSwitchvox 8.4.0.2<\/span>\u00a0<\/span><\/td>\n<\/tr>\n
Patch release date<\/span><\/b>\u00a0<\/span><\/td>\nJuly 14, 2026<\/span>\u00a0<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

What Is CVE-2026-9586 in Sangoma Switchvox?<\/h2>\n

CVE-2026-9586<\/a> is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition. It affects the \/pa<\/code> HTTP endpoint and can allow a remote attacker to execute operating-system commands through crafted XML input.<\/p>\n

The vulnerability is particularly significant because exploitation requires neither authentication nor user interaction. As a result, vulnerable Switchvox systems reachable from untrusted networks can face remote exploitation attempts.<\/p>\n

How the Switchvox \/pa Endpoint Turns SQL Injection Into RCE<\/h2>\n

The distinctive mechanism behind the Sangoma Switchvox attack starts with an unauthenticated XML request reaching the underlying PostgreSQL database.<\/p>\n

Switchvox exposes an unauthenticated \/pa<\/code> HTTP endpoint for functionality associated with supported phones. Horizon3 traced requests to this endpoint through the PhoneAppsHandler.pm<\/code> handler.<\/p>\n

The vulnerable processing flow works as follows:<\/p>\n

    \n
  1. The \/pa<\/code> endpoint receives the HTTP request body.<\/li>\n
  2. Switchvox verifies that the body begins with <PolycomIPPhone><\/code>.<\/li>\n
  3. The application parses the supplied XML.<\/li>\n
  4. It extracts the attacker-controlled PhoneIP<\/code> value.<\/li>\n
  5. The application concatenates that value directly into an SQL query without parameterization.<\/li>\n
  6. The resulting query executes against PostgreSQL.<\/li>\n<\/ol>\n

    Critically, Horizon3 reported that the database query executes as a PostgreSQL superuser.<\/p>\n

    As a result, exploitation can move beyond database manipulation. A crafted query can use PostgreSQL functionality to execute commands on the underlying operating system.<\/p>\n

    Therefore, CVE-2026-9586 is not simply a database confidentiality issue. An unauthenticated network request can cross the database boundary and reach operating-system command execution.<\/p>\n

    Attackers Are Exploiting CVE-2026-9586 Against Switchvox Honeypots<\/h2>\n

    The Switchvox vulnerability is no longer only a proof-of-concept risk.<\/p>\n

    Horizon3 and Defused Cyber deployed internet-facing Switchvox honeypots in May 2026 to watch for exploitation. On August 30, 2026, those systems recorded valid exploitation attempts.<\/p>\n

    The activity originated from 176.65.148.184.<\/p>\n

    The first observed payload used Netcat to connect to 176.65.148.184 on port 39323 and piped data from that connection into sh<\/code>, providing a mechanism for remote command execution.<\/p>\n

    Next, a command gathered information about running processes. It decoded a Base64<\/a>-encoded shell instruction and extracted information about the top process. Then, it used curl<\/code> to send the resulting information to a remote server.<\/p>\n

    Horizon3 reported that the same source rapidly targeted multiple honeypots.<\/p>\n

    However, the available research does not establish broader post-exploitation activity such as credential theft, persistence or lateral movement. These remain possible consequences of server compromise, not confirmed outcomes of the observed activity.<\/p>\n

    Why Internet-Exposed Switchvox Systems Face Higher Exploitation Risk<\/h2>\n

    The Switchvox exploit requires no authenticated account or user interaction.<\/p>\n

    Therefore, vulnerable installations reachable from untrusted networks are particularly important to identify. An attacker capable of reaching the vulnerable HTTP endpoint can attempt exploitation remotely.<\/p>\n

    Horizon3 reported approximately 4,000 internet-visible Switchvox devices in Shodan when it published its research. In addition, the researchers observed rapid targeting across multiple honeypots. They said this activity suggested widespread scanning or exploitation attempts against exposed systems.<\/p>\n

    For enterprise VoIP security, this exposure deserves attention because Switchvox can form part of business-critical communications infrastructure. Successful exploitation can provide command execution within an environment connected to corporate networks.<\/p>\n

    However, the confirmed activity does not establish that attackers moved from Switchvox into adjacent systems. Organizations should investigate exposed systems rather than assume that patching removes evidence of an earlier compromise.<\/p>\n

    How to Check Switchvox for CVE-2026-9586 Exploitation<\/h2>\n

    Organizations running vulnerable Switchvox installations should first determine whether their systems were accessible from untrusted networks.<\/p>\n

    Where administrators have SSH<\/a> access, Horizon3 recommends inspecting:<\/p>\n

    \/var\/log\/switchvox\/db-quirks.log<\/code><\/p>\n

    The log can contain evidence of SQL statements associated with exploitation attempts.<\/p>\n

    In addition, security teams should review available network telemetry for:<\/p>\n