Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. According to security researchers at Horizon3, most of the internet-exposed Switchvox systems have either already been targeted or will be soon. Switchvox is an enterprise VoIP management platform used to configure and monitor business phone systems. CVE-2026-9586 is the most serious of 12 flaws Horizon3 discovered and reported to Sangoma on April 10. The vendor fixed them in Switchvox version 8.4.0.2, released on July 14. The vulnerability is an unauthenticated SQL injection problem in Sangoma Switchvox’s /pa HTTP endpoint. The researchers explain that the endpoint is exposed and parses an XML message containing specific key-value pairs. When /pa receives a request to notify another phone system, such as for an incoming or outgoing call event, it extracts the PhoneIP field from the XML message and directly concatenates its value into an unparameterized SQL query. The researchers demonstrated that this SQL injection can be exploited remotely to execute operating-system commands through a crafted XML request sent using the curl command. On August 30, Horizon3’s honeypots observed active exploitation on multiple systems in rapid succession from a single source IP address (176.65.148.184), with the attacker attempting to establish a reverse shell. In these attempts, the attacker executed an initial payload...