Critical Sangoma Switchvox RCE Vulnerability Actively Exploited

Key Takeaways

• A critical remote code execution (RCE) vulnerability, CVE-2026-9586, in Sangoma Switchvox VoIP systems is under active exploitation.
• The flaw is an unauthenticated SQL injection that allows attackers to execute arbitrary commands remotely without credentials.
• The vulnerability impacts Sangoma Switchvox SMB Edition 8.3, build 104997, and earlier versions.
• Horizon3.ai researchers observed exploitation attempts deploying reverse shells and conducting reconnaissance on August 30, 2026.
• A patch, version 8.4.0.2, was released on July 14, 2026, and organizations are urged to update immediately.

A severe vulnerability within Sangoma Switchvox, a widely used enterprise VoIP platform for managing business communication systems, is currently being actively exploited by malicious actors. This flaw presents a significant risk to organizations utilizing the affected software.

Designated as CVE-2026-9586, this critical vulnerability enables unauthenticated attackers to achieve remote code execution (RCE) on vulnerable systems. This means an attacker can run commands on the target system without requiring any valid login credentials, posing an immediate and severe threat.

On August 30, 2026, security researchers at Horizon3.ai documented active exploitation attempts targeting internet-exposed Switchvox devices. These attacks involved efforts to establish reverse shells, granting attackers remote command-line access to compromised VoIP servers.

Technical Details of CVE-2026-9586

CVE-2026-9586 is categorized as an unauthenticated SQL injection vulnerability. It specifically affects Sangoma Switchvox SMB Edition 8.3, build 104997, and all prior releases. The vulnerability carries a high CVSS severity score of 9.3, reflecting its potential for remote code execution.

The root cause lies in an unauthenticated HTTP endpoint, /pa, which is responsible for processing XML messages from supported IP phones. These messages are used for critical events such as call notifications. Horizon3 researchers discovered that Switchvox directly incorporates the PhoneIP value from an incoming XML request into a PostgreSQL database query without proper sanitization or parameterization of user-controlled input. This oversight allows a remote attacker to inject malicious SQL commands via a specially crafted request.

Because the database query executes with elevated PostgreSQL permissions, a successful SQL injection can lead to the execution of arbitrary operating system commands on the underlying Switchvox server. This level of access could enable attackers to exfiltrate database contents, modify user data, create or elevate administrator accounts, steal authentication credentials, and establish persistent backdoor access to the compromised system.

Active Exploitation Observed

To monitor for exploitation, Horizon3 and Defused Cyber deployed a network of internet-facing honeypots. On August 30, researchers detected a series of rapid attacks originating from the IP address 176.65.148.184 across multiple honeypots. The observed activities included attempts to launch a reverse shell using Netcat. Following this, attackers utilized Base64-encoded commands to gather information on active processes running on the vulnerable Switchvox appliance. The data collected was then prepared for transmission to an attacker-controlled server, indicating that the attackers were performing post-exploitation reconnaissance after gaining initial access.

Horizon3 warned that the rapid and widespread nature of these exploitation attempts suggests that internet-exposed Switchvox systems are likely being broadly scanned and targeted. Researchers identified approximately 4,000 Switchvox devices accessible online, with the majority located within the United States.

Patch and Mitigation

Horizon3 initially reported a total of 12 vulnerabilities to Sangoma in April 2026. Sangoma subsequently released Switchvox version 8.4.0.2 on July 14, 2026, which effectively addresses CVE-2026-9586 and other reported issues.

What You Should Do

• Immediate Upgrade: Organizations must prioritize upgrading their Sangoma Switchvox installations to version 8.4.0.2 or any later supported release without delay.
• Log Review: Administrators should scrutinize /var/log/switchvox/db-quirks.log for any suspicious SQL statements that might indicate compromise.
• Network Analysis: Investigate any network connections involving the IP address 176.65.148.184 for signs of malicious activity.
• Restrict Access: Where feasible, restrict network access to the /pa endpoint, limiting it only to trusted internal phone networks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.