Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Summary

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in Sangoma Switchvox VoIP platform that enables remote code execution. Horizon3 researchers discovered the flaw affecting the /pa HTTP endpoint and observed active exploitation attempts from IP 176.65.148.184 on August 30, with attackers attempting to establish reverse shells. With approximately 4,000 internet-exposed Switchvox instances, Sangoma urges immediate upgrade to version 8.4.0.2 or later.

Full text

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells By Bill Toulas September 2, 2026 05:00 PM 0 Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. According to security researchers at Horizon3, most of the internet-exposed Switchvox systems have either already been targeted or will be soon. Switchvox is an enterprise VoIP management platform used to configure and monitor business phone systems. CVE-2026-9586 is the most serious of 12 flaws Horizon3 discovered and reported to Sangoma on April 10. The vendor fixed them in Switchvox version 8.4.0.2, released on July 14. The vulnerability is an unauthenticated SQL injection problem in Sangoma Switchvox’s /pa HTTP endpoint. The researchers explain that the endpoint is exposed and parses an XML message containing specific key-value pairs. When /pa receives a request to notify another phone system, such as for an incoming or outgoing call event, it extracts the PhoneIP field from the XML message and directly concatenates its value into an unparameterized SQL query. The researchers demonstrated that this SQL injection can be exploited remotely to execute operating-system commands through a crafted XML request sent using the curl command. Exploit for CVE-2026-9586Source: Horizon3 On August 30, Horizon3’s honeypots observed active exploitation on multiple systems in rapid succession from a single source IP address (176.65.148.184), with the attacker attempting to establish a reverse shell. In these attempts, the attacker executed an initial payload and then collected information about the top processes running on the Swithvox system. The data was then transmitted to a remote server in base64-encoded form. “Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet-exposed Switchvox instances will be or have already been targeted,” Horizon3 warns. “Currently Shodan shows that there are approximately 4,000 devices on the internet, with most located within the United States.” Horizon3 says it has not seen active exploitation of the remaining 11 flaws it discovered earlier. With CVE-2026-9586 being actively exploited, system administrators are recommended to upgrade to Switchvox version 8.4.0.2 or later as soon as possible, and check for signs of having been targeted in the meantime. Signs of compromise include suspicious statements in /var/log/switchvox/db-quirks.log and network connections to the observed attacker IP, particularly on port 39323. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Critical Langflow flaw exploited to steal OpenAI and AWS keysOne threat actor responsible for 83% of recent Ivanti RCE attacksCISA orders urgent patching of actively exploited Zimbra flawMicrosoft patches max severity code execution, privilege escalation flawsCritical Zimbra RCE flaw now actively exploited in attacks

Indicators of Compromise

• cve — CVE-2026-9586
• ip — 176.65.148.184

Entities