Attackers are actively exploiting a critical Sangoma Switchvox flaw to run commands and deploy reverse shells on exposed business phone systems. The vulnerability, tracked as CVE-2026-9586, affects the enterprise VoIP platform and requires no authentication.
Security researchers at Horizon3 observed attacks against multiple honeypots on August 30. They warn that attackers may have already targeted, or will soon target, most internet-exposed Switchvox systems.
Unauthenticated SQL injection leads to code execution
The Sangoma Switchvox flaw is an SQL injection vulnerability in the platform’s exposed /pa HTTP endpoint. Switchvox uses this endpoint to handle XML messages related to phone-system events.
Researchers found that the endpoint extracts the PhoneIP value from incoming XML and adds it directly to an SQL query without using safe parameterisation.
An attacker can send a crafted request to exploit the flaw remotely. Successful exploitation allows the attacker to execute operating-system commands on the targeted Switchvox system.
That access can lead to a reverse shell, giving the attacker a persistent remote connection to the device.
Attackers target internet-exposed phone systems
Horizon3 reported the issue to Sangoma on April 10 as part of a group of 12 security flaws. CVE-2026-9586 was the most serious issue in the disclosure.
Sangoma released a fix in Switchvox version 8.4.0.2 on July 14. However, researchers later saw attackers exploiting the vulnerability in the wild.
During the observed attacks, one source IP address targeted several honeypot systems in quick succession. The attacker tried to establish reverse shells, collect a list of the busiest processes and send the results to a remote server in Base64-encoded form.
Horizon3 said internet scanning data showed around 4,000 exposed Switchvox devices, with most located in the United States.
Administrators should update Switchvox now
System administrators should update to Switchvox version 8.4.0.2 or later without delay. The active exploitation of the Sangoma Switchvox flaw means unpatched systems face an immediate risk.
Administrators should also investigate systems for signs of attempted or successful compromise. Horizon3 recommends checking /var/log/switchvox/db-quirks.log for suspicious entries.
Teams should also review network logs for unexpected outbound connections, particularly connections to the observed attacker infrastructure on port 39323.
The researchers have not observed active exploitation of the other 11 vulnerabilities they reported to Sangoma. However, the active attacks against CVE-2026-9586 make patching the priority for all organisations using Switchvox.
0 responses to “Sangoma Switchvox Flaw Exploited to Deploy Reverse Shells”