Sangoma Switchvox CVE-2026-9586: Pre-Auth SQLi to RCE

What to do

1. Check the Switchvox version in the admin interface and upgrade anything below 8.4.0.2 to 8.4.0.2 or later.
2. Remove internet exposure of the Switchvox web interface; allow only phone VLANs, trusted admin networks or a VPN to reach it.
3. If you cannot upgrade immediately, block external access to the /pa path at your firewall or reverse proxy.
4. Review /var/log/switchvox/db-quirks.log for COPY ... TO PROGRAM statements and hunt for compromise on any system that was exposed after August 30.
5. If you find signs of compromise, rebuild the system and rotate SIP trunk, admin and extension credentials.

How to check if you are affected or compromised

• Search /var/log/switchvox/db-quirks.log for SQL containing COPY ... TO PROGRAM, especially with nc or curl commands.
• Search firewall and NetFlow logs for traffic between Switchvox and 176.65.148.184, including outbound connections to port 39323.
• Look for unexpected outbound connections from the PBX and unfamiliar processes such as nc or sh spawned by the database service.

What happened#

On July 14, 2026, Sangoma released Switchvox 8.4.0.2 (build 105309). The release fixes a batch of security bugs in its on-premises business phone system, including CVE-2026-9586, an unauthenticated SQL injection that leads to remote code execution. The CVE record describes the bug. The /pa endpoint accepts XML that starts with <PolycomIPPhone> and "directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization." A single crafted request is enough. The CNA, Security Risk Advisors, scores it CVSS 4.0 9.3. NVD rates it 3.1 9.8.

Two teams found it independently. Horizon3.ai reported 12 Switchvox flaws to Sangoma on April 10, and Sangoma had a pre-release fix by April 21. SRA's Cam Lischke reported separately in May and published the CVE on July 17. Horizon3 explains why SQL injection here means code execution. The handler (PhoneAppsHandler.pm) runs injected SQL as the PostgreSQL superuser, so COPY ... TO PROGRAM runs operating-system commands.

Horizon3 and Defused Cyber honeypots recorded the first valid exploitation attempt on August 30. The attacker piped a netcat connection into sh, then used curl to send a base64-encoded process listing to their server. Horizon3 published on September 1, and CISA added the CVE to the KEV catalog on September 2, with a September 5 deadline, in a batch SecurityWeek notes included six other exploited bugs.

Who is affected#

The CVE record lists Switchvox SMB Edition 8.3 (build 104997) up to, but not including, 8.4.0.2. Sangoma's release notes list the same CVE against 8.2.2.1. Treat every build before 8.4.0.2 as vulnerable. Horizon3 counted roughly 4,000 internet-exposed Switchvox systems on Shodan, mostly in the United States. Whether Sangoma's hosted Switchvox Cloud was exposed is not clear from the public notes as of Oct 21, 2026. Cloud customers should ask Sangoma to confirm, in writing, the version they run.

The same release fixed more Switchvox bugs, including other SQL injection, command injection, path traversal, SSRF and XSS issues: CVE-2026-85070 to -85075 and CVE-2026-9585, -9587 and -9588. Horizon3 told BleepingComputer it had not seen the other 11 of its flaws exploited.

Do you really need to act?#

Yes, if any Switchvox below 8.4.0.2 is reachable from an untrusted network. The bug needs no login, no user interaction and no special configuration, and the exploit is one HTTP request. Horizon3 saw the same IP hit multiple honeypots in quick succession and warned that "most internet-exposed Switchvox instances will be or have already been targeted." The fix has been out since July. A system still unpatched in late October has been exposed for nearly two months of active exploitation, so check it for compromise after you patch.

A PBX is a valuable foothold. It holds SIP trunk credentials that can be abused for toll fraud, along with call records and voicemail, and it usually sits on internal voice and data VLANs. Systems reachable only from an internal phone VLAN are at lower risk, but they are still one compromised workstation away. Patch them on a short cycle.

What to do now#

1. Check the version in the Switchvox admin interface and upgrade to 8.4.0.2 or later. Upgrades from 7.x to 8.x have hardware and feature caveats in Sangoma's 8.0.1 notes.
2. Close internet access to the web interface. Allow only phone networks, trusted admin hosts or a VPN.
3. If the upgrade must wait, block external requests to /pa at the firewall or reverse proxy. This is a stopgap, not a fix.
4. After patching, check every exposed system for compromise as described below.

How to tell if you were hit#

If you have SSH access, Horizon3 points to /var/log/switchvox/db-quirks.log, for example grep -i "to program" /var/log/switchvox/db-quirks.log. Exploit attempts appear as SQL containing COPY ... TO PROGRAM with a netcat or curl command. Search firewall logs for traffic to or from 176.65.148.184. BleepingComputer also flags connections on port 39323. Other attackers will use other infrastructure, so look for any unexpected outbound connection from the PBX. If you find evidence of compromise, rebuild from a clean install on 8.4.0.2 or later. Then rotate SIP trunk, admin and extension passwords, and review call detail records for toll fraud.

Timeline#

• Apr 10, 2026 — Horizon3 reports 12 Switchvox flaws to Sangoma.
• May 11, 2026 — SRA independently begins reporting issues.
• Jul 14, 2026 — Sangoma releases Switchvox 8.4.0.2.
• Jul 17, 2026 — SRA publishes its advisory; CVE-2026-9586 goes public.
• Aug 30, 2026 — Honeypots record the first exploitation attempt.
• Sep 1, 2026 — Horizon3 publishes details and indicators.
• Sep 2, 2026 — CISA adds the CVE to KEV, due September 5.

Vulnerability records

• CVE-2026-9586 · KEV 2026-09-02 · An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Sangoma — Switchvox Release Notes, Version 8.4.0.2 (July 14, 2026) sangomakb.atlassian.net
2. Security Risk Advisors — Sangoma Switchvox SMB advisory labs.sra.io
3. Horizon3.ai — CVE-2026-9586: Sangoma Switchvox RCE horizon3.ai
4. CVE record — CVE-2026-9586 cve.org
5. NVD — CVE-2026-9586 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-9586 cisa.gov

Coverage and analysis

1. BleepingComputer — Hackers exploit Sangoma Switchvox flaw to deploy reverse shells bleepingcomputer.com
2. SecurityWeek — Sangoma Switchvox Vulnerability Exploited in the Wild securityweek.com