- The Mess: Sangoma Switchvox has a critical unauthenticated SQL injection tracked as CVE-2026-9586, and attackers are already exploiting it in the wild. The bug carries a CVSS score of 9.3 and can turn a single crafted HTTP request into remote code execution.
The vulnerable endpoint is /pa, which handles XML messages used by Switchvox to process phone events. One field, PhoneIP, gets inserted directly into a PostgreSQL query without proper sanitization or parameterization.
That is enough to break the boundary between a phone notification endpoint and the underlying server.
Horizon3 researchers confirmed that the flaw can be exploited remotely without credentials. Their testing showed that an attacker can execute SQL statements and ultimately operating-system commands with the privileges of the PostgreSQL superuser.
And this is no longer theoretical.
On August 30, Horizon3 observed attackers hitting multiple internet-exposed Switchvox honeypots in rapid succession. The activity included attempts to establish reverse shells and collect information from compromised systems before sending the results to an external server.
- The Damage: A compromised Switchvox server can become a foothold inside a company’s communications infrastructure, exposing call-system data, credentials, configuration and potentially giving attackers command-line access to the underlying host.
Switchvox is not some random desktop application. It sits in the middle of business communications, handling phone systems, voicemail, call routing and other telephony functions.
The vulnerable release is Switchvox SMB Edition 8.3 build 104997 and earlier affected releases. Sangoma patched the issue in Switchvox 8.4.0.2, released July 14, 2026.
CISA has now added CVE-2026-9586 to its Known Exploited Vulnerabilities catalog. That matters because defenders are no longer dealing with a vulnerability that might be abused someday. There is evidence that attackers are already hunting exposed systems.
Horizon3 estimates that roughly 4,000 Switchvox devices are exposed on the public internet, with most located in the United States.
- The Fix: Upgrade Switchvox to 8.4.0.2 or later immediately, remove unnecessary internet exposure, and investigate logs and outbound connections for signs of compromise before assuming that patching alone cleaned up an already-hit server.
Administrators should pay particular attention to suspicious activity in /var/log/switchvox/db-quirks.log and unexpected connections involving the infrastructure observed during exploitation. If compromise is confirmed, treat the system as breached rather than simply patched.
Bugstoday Opinion
This is exactly the kind of vulnerability attackers love: no password, one exposed endpoint, and a straight path from malformed XML to operating-system commands.
VoIP infrastructure is often forgotten during vulnerability management because everyone watches firewalls, VPNs and Windows servers first. Meanwhile, the phone system sits on the network quietly doing its job.
Until someone turns it into a shell.
CVE-2026-9586 is already in CISA KEV and exploitation has been observed. There is no good reason for an exposed Switchvox 8.3 installation to still exist.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
Horizon3.ai — CVE-2026-9586 Sangoma Switchvox RCE research
CISA — Known Exploited Vulnerabilities Catalog
NVD — CVE-2026-9586
Sangoma — Switchvox 8.4.0.2 security fix
