Active attacks target Sangoma Switchvox SQL injection flaw

Threat actors are actively attempting to exploit a critical vulnerability in Sangoma Switchvox, a business VoIP management platform, to gain remote command execution and establish reverse-shell access on exposed systems.

The flaw, tracked as CVE-2026-9586, is an unauthenticated SQL injection issue affecting the platform’s publicly reachable /pa endpoint. Researchers at Horizon3 reported that specially formed XML requests can cause Switchvox to incorporate attacker-controlled data into a database query, ultimately enabling commands to run on the underlying host.

Horizon3 identified the vulnerability as the most severe of 12 issues it disclosed to Sangoma in April. Sangoma addressed the findings in Switchvox version 8.4.0.2, released on July 14.

Honeypots record reverse-shell attempts

On August 30, Horizon3 honeypots detected exploitation activity against several systems in quick succession. The observed attempts came from a single IP address and included efforts to open a reverse shell, run an initial command payload, and gather information on active processes. The collected data was reportedly encoded and sent to an external server.

The researchers said the pace and breadth of the activity suggest that attackers are likely scanning for internet-accessible Switchvox deployments. Shodan data cited by Horizon3 indicated that roughly 4,000 Switchvox devices were exposed online, with a substantial portion located in the United States.

Horizon3 said it had not observed exploitation of the other 11 vulnerabilities included in its earlier disclosure. However, active exploitation of CVE-2026-9586 increases the urgency for organizations running Switchvox to review their exposure.

Recommended actions

• Upgrade Switchvox installations to version 8.4.0.2 or a later supported release.
• Review logs, including /var/log/switchvox/db-quirks.log, for unusual database-related entries or unexpected requests.
• Investigate suspicious outbound connections, particularly those involving the IP address identified in the research and port 39323.
• Limit public access to VoIP administration services where possible and monitor systems for unexpected processes or command execution.

Organizations that identify indicators of compromise should isolate affected hosts, preserve relevant logs, rotate credentials, and conduct a full incident response review.