Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution.
According to security researchers at Horizon3, most of the internet-exposed Switchvox systems have either already been targeted or will be soon.
Switchvox is an enterprise VoIP management platform used to configure and monitor business phone systems.
CVE-2026-9586 is the most serious of 12 flaws Horizon3 discovered and reported to Sangoma on April 10. The vendor fixed them in Switchvox version 8.4.0.2, released on July 14.
The vulnerability is an unauthenticated SQL injection problem in Sangoma Switchvox’s /pa HTTP endpoint. The researchers explain that the endpoint is exposed and parses an XML message containing specific key-value pairs.
When /pa receives a request to notify another phone system, such as for an incoming or outgoing call event, it extracts the PhoneIP field from the XML message and directly concatenates its value into an unparameterized SQL query.
The researchers demonstrated that this SQL injection can be exploited remotely to execute operating-system commands through a crafted XML request sent using the curl command.
Source: Horizon3
On August 30, Horizon3’s honeypots observed active exploitation on multiple systems in rapid succession from a single source IP address (176.65.148.184), with the attacker attempting to establish a reverse shell.
In these attempts, the attacker executed an initial payload and then collected information about the top processes running on the Swithvox system. The data was then transmitted to a remote server in base64-encoded form.
“Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet-exposed Switchvox instances will be or have already been targeted,” Horizon3 warns.
“Currently Shodan shows that there are approximately 4,000 devices on the internet, with most located within the United States.”
Horizon3 says it has not seen active exploitation of the remaining 11 flaws it discovered earlier.
With CVE-2026-9586 being actively exploited, system administrators are recommended to upgrade to Switchvox version 8.4.0.2 or later as soon as possible, and check for signs of having been targeted in the meantime.
Signs of compromise include suspicious statements in /var/log/switchvox/db-quirks.log and network connections to the observed attacker IP, particularly on port 39323.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
