Sangoma Switchvox Vulnerabilities Exploited in the Wild

A critical SQL injection vulnerability in Sangoma Switchvox (CVE-2026-9586) is being actively exploited in the wild, enabling threat actors to achieve remote code execution on affected VoIP systems. The root cause lies in insufficient input validation within the telephony management platform, a fundamental secure coding failure. Because VoIP systems are often internet-facing and deeply integrated into business communications infrastructure, a successful exploit can lead to call interception, data exfiltration, or full system compromise. CISA's addition of this CVE to its Known Exploited Vulnerabilities catalog signals that organizations still running unpatched versions face an imminent and credible threat. The severity underscores how legacy or under-monitored network appliances frequently become high-value targets when patches are not applied promptly.