Cybersecurity experts are raising alarms over a critical security flaw in the Sangoma Switchvox VoIP platform. This vulnerability, identified as CVE-2026-9586, is being actively exploited by threat actors to execute remote code without requiring any authentication.
Understanding the Sangoma Switchvox Flaw
The vulnerability, which has been assigned a CVSS score of 9.3, is a severe unauthenticated SQL injection flaw present in Sangoma Switchvox SMB Edition 8.3 (104997). This security gap allows malicious actors to execute arbitrary code remotely with the privileges of a PostgreSQL superuser, bypassing the need for credentials. Sangoma addressed this issue with the release of patches in version 8.4.0.2 on July 14, 2026.
According to CVE.org, the flaw stems from the way the /pa endpoint processes XML input, directly inserting user-supplied PhoneIP data into PostgreSQL queries without proper sanitization. This oversight enables attackers to craft requests that can compromise the backend database and execute remote commands.
Exploitation and Impact
Horizon3.ai has reported that CVE-2026-9586 is one of 12 vulnerabilities reported to Sangoma in April 2026. Exploitation attempts were first observed on August 30, 2026, with approximately 4,000 vulnerable instances, predominantly in the U.S., exposed to the internet.
Independent discovery and reporting of the same flaw were made by Security Risk Advisors (SRA) Labs in May. They demonstrated that unauthenticated attackers could manipulate database operations, extract data, modify records, and elevate privileges to Switchvox web administrators. Moreover, attackers could execute arbitrary code, including reverse shells.
Indicators of Compromise and Mitigation
Attackers have been observed deploying reverse shells on compromised systems and using Base64-encoded commands to investigate running processes. Notably, devices with SSH access show SQL injection payload traces in ‘/var/log/switchvox/db-quirks.log’, and the attacking IP address ‘176.65.148[.]184’ has been flagged for malicious activities.
Zach Hanley, a security researcher, warns of widespread targeting of internet-exposed Switchvox instances, driven by rapid exploit attempts from a single source IP across multiple honeypots.
The prompt application of patches provided by Sangoma is crucial to mitigate these threats. Organizations using the affected versions of Switchvox should update immediately to protect against potential breaches.
