Attackers are actively exploiting an unauthenticated SQL injection vulnerability in Sangoma's Switchvox VoIP platform, designated CVE-2026-9586, to achieve remote code execution and deploy reverse shells. Security researchers at Horizon3, who discovered the flaw, indicate that a significant number of internet-exposed Switchvox systems have likely already been targeted or are at imminent risk.
Switchvox is an enterprise VoIP management platform used for configuring and monitoring business phone systems. Horizon3 identified CVE-2026-9586 as the most critical among 12 vulnerabilities they reported to Sangoma on April 10. Sangoma subsequently released Switchvox version 8.4.0.2 on July 14, which includes fixes for all reported issues.
The vulnerability resides in the `/pa` HTTP endpoint of Sangoma Switchvox. This endpoint is exposed and processes XML messages containing specific key-value pairs. When `/pa` receives a request to notify another phone system, such as for an incoming or outgoing call event, it extracts the `PhoneIP` field from the XML message. The value of this field is then directly concatenated into an unparameterized SQL query, creating the SQL injection vulnerability.
Researchers demonstrated that a crafted XML request, sent via a `curl` command, can exploit this SQL injection remotely to execute operating-system commands. On August 30, Horizon3's honeypots detected active exploitation attempts on multiple systems in rapid succession. These attempts originated from a single source IP address, 176.65.148.184.
During these attacks, the threat actor executed an initial payload and then gathered information about the top processes running on the Switchvox system. This collected data was subsequently transmitted to a remote server in a base64-encoded format. The rapid succession of exploit attempts across multiple honeypots from the same IP address suggests widespread targeting of internet-exposed Switchvox instances.
Currently, approximately 4,000 Switchvox devices are accessible on the internet, with the majority located in the United States. While CVE-2026-9586 is being actively exploited, Horizon3 has not observed active exploitation of the other 11 flaws they previously discovered.
Given the ongoing exploitation, system administrators are strongly advised to upgrade to Switchvox version 8.4.0.2 or a later release as soon as possible. Additionally, administrators should check for signs of compromise, which may include suspicious entries in `/var/log/switchvox/db-quirks.log` and network connections to the attacker's observed IP address, particularly on port 39323.
