Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

CVE-2026-9586 exposes a critical unauthenticated SQL injection flaw in Sangoma Switchvox's /pa HTTP endpoint, allowing attackers to achieve remote code execution without any valid credentials. With roughly 4,000 instances directly exposed to the internet, the attack surface is significant and exploitation is already confirmed in the wild. The core failure lies in inadequate input validation on a public-facing endpoint combined with the absence of timely patching and unnecessary internet exposure of VoIP infrastructure. This matters because VoIP platforms often sit at the intersection of communications and network access, making compromise a gateway to broader organizational damage including eavesdropping, lateral movement, and data exfiltration.