---
title: "Sangoma Switchvox CVE-2026-9586: Pre-Auth SQLi to RCE"
url: https://erroneo.us/security/briefs/sangoma-switchvox-cve-2026-9586-pre-auth-sqli-rce/
description: "Unauthenticated SQL injection in the Switchvox /pa endpoint runs OS commands and has been exploited since Aug 30. Fixed in 8.4.0.2. Patch exposed PBXs now."
type: security-brief
section: "Security Digest"
date_published: 2026-07-14
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-9586"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Sangoma Switchvox CVE-2026-9586: Pre-Auth SQLi to RCE

**Verdict: Act now.** A single unauthenticated request turns an unpatched Switchvox PBX into a shell; if yours is below 8.4.0.2 and reachable from the internet, upgrade today and check it for compromise.

- **Who must act:** Anyone running an on-premises Sangoma Switchvox phone system below 8.4.0.2, most urgently where its web interface is reachable from the internet.
- **Who can relax:** Switchvox systems already on 8.4.0.2 (released July 14, 2026) or later, and organizations not running Switchvox; FreePBX is a separate Sangoma product with its own advisories.
- **Affected:** Switchvox SMB Edition 8.3 (build 104997) and other builds before 8.4.0.2 (Sangoma's release notes also list the flaw against 8.2.2.1)
- **Fixed:** Switchvox 8.4.0.2 (build 105309) or later
- **CVEs:** CVE-2026-9586
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the Switchvox version in the admin interface and upgrade anything below 8.4.0.2 to 8.4.0.2 or later.
2. Remove internet exposure of the Switchvox web interface; allow only phone VLANs, trusted admin networks or a VPN to reach it.
3. If you cannot upgrade immediately, block external access to the /pa path at your firewall or reverse proxy.
4. Review /var/log/switchvox/db-quirks.log for COPY ... TO PROGRAM statements and hunt for compromise on any system that was exposed after August 30.
5. If you find signs of compromise, rebuild the system and rotate SIP trunk, admin and extension credentials.

### How to check if you are affected

- Search /var/log/switchvox/db-quirks.log for SQL containing COPY ... TO PROGRAM, especially with nc or curl commands.
- Search firewall and NetFlow logs for traffic between Switchvox and 176.65.148.184, including outbound connections to port 39323.
- Look for unexpected outbound connections from the PBX and unfamiliar processes such as nc or sh spawned by the database service.

## What happened

On July 14, 2026, Sangoma released [Switchvox 8.4.0.2 (build 105309)](https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026). The release fixes a batch of security bugs in its on-premises business phone system, including [CVE-2026-9586](https://www.cve.org/CVERecord?id=CVE-2026-9586), an unauthenticated SQL injection that leads to remote code execution. The CVE record describes the bug. The `/pa` endpoint accepts XML that starts with `<PolycomIPPhone>` and "directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization." A single crafted request is enough. The CNA, Security Risk Advisors, scores it CVSS 4.0 9.3. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-9586) rates it 3.1 9.8.

Two teams found it independently. [Horizon3.ai](https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/) reported 12 Switchvox flaws to Sangoma on April 10, and Sangoma had a pre-release fix by April 21. [SRA's Cam Lischke](https://labs.sra.io/posts/switchvox/) reported separately in May and published the CVE on July 17. Horizon3 explains why SQL injection here means code execution. The handler (`PhoneAppsHandler.pm`) runs injected SQL as the PostgreSQL superuser, so `COPY ... TO PROGRAM` runs operating-system commands.

Horizon3 and Defused Cyber honeypots recorded the first valid exploitation attempt on August 30. The attacker piped a netcat connection into `sh`, then used `curl` to send a base64-encoded process listing to their server. Horizon3 published on September 1, and CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586) on September 2, with a September 5 deadline, in a batch [SecurityWeek](https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/) notes included six other exploited bugs.

## Who is affected

The CVE record lists Switchvox SMB Edition 8.3 (build 104997) up to, but not including, 8.4.0.2. Sangoma's release notes list the same CVE against 8.2.2.1. Treat every build before 8.4.0.2 as vulnerable. Horizon3 counted roughly 4,000 internet-exposed Switchvox systems on Shodan, mostly in the United States. Whether Sangoma's hosted Switchvox Cloud was exposed is not clear from the public notes as of Oct 21, 2026. Cloud customers should ask Sangoma to confirm, in writing, the version they run.

The same release fixed more Switchvox bugs, including other SQL injection, command injection, path traversal, SSRF and XSS issues: CVE-2026-85070 to -85075 and CVE-2026-9585, -9587 and -9588. Horizon3 told [BleepingComputer](https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/) it had not seen the other 11 of its flaws exploited.

## Do you really need to act?

**Yes, if any Switchvox below 8.4.0.2 is reachable from an untrusted network.** The bug needs no login, no user interaction and no special configuration, and the exploit is one HTTP request. Horizon3 saw the same IP hit multiple honeypots in quick succession and warned that "most internet-exposed Switchvox instances will be or have already been targeted." The fix has been out since July. A system still unpatched in late October has been exposed for nearly two months of active exploitation, so check it for compromise after you patch.

A PBX is a valuable foothold. It holds SIP trunk credentials that can be abused for toll fraud, along with call records and voicemail, and it usually sits on internal voice and data VLANs. Systems reachable only from an internal phone VLAN are at lower risk, but they are still one compromised workstation away. Patch them on a short cycle.

## What to do now

1. Check the version in the Switchvox admin interface and upgrade to 8.4.0.2 or later. Upgrades from 7.x to 8.x have hardware and feature caveats in Sangoma's 8.0.1 notes.
2. Close internet access to the web interface. Allow only phone networks, trusted admin hosts or a VPN.
3. If the upgrade must wait, block external requests to `/pa` at the firewall or reverse proxy. This is a stopgap, not a fix.
4. After patching, check every exposed system for compromise as described below.

## How to tell if you were hit

If you have SSH access, Horizon3 points to `/var/log/switchvox/db-quirks.log`, for example `grep -i "to program" /var/log/switchvox/db-quirks.log`. Exploit attempts appear as SQL containing `COPY ... TO PROGRAM` with a netcat or curl command. Search firewall logs for traffic to or from `176.65.148.184`. BleepingComputer also flags connections on port `39323`. Other attackers will use other infrastructure, so look for any unexpected outbound connection from the PBX. If you find evidence of compromise, rebuild from a clean install on 8.4.0.2 or later. Then rotate SIP trunk, admin and extension passwords, and review call detail records for toll fraud.

## Timeline

- Apr 10, 2026 — Horizon3 reports 12 Switchvox flaws to Sangoma.
- May 11, 2026 — SRA independently begins reporting issues.
- Jul 14, 2026 — Sangoma releases Switchvox 8.4.0.2.
- Jul 17, 2026 — SRA publishes its advisory; CVE-2026-9586 goes public.
- Aug 30, 2026 — Honeypots record the first exploitation attempt.
- Sep 1, 2026 — Horizon3 publishes details and indicators.
- Sep 2, 2026 — CISA adds the CVE to KEV, due September 5.

## Sources

1. [Sangoma — Switchvox Release Notes, Version 8.4.0.2 (July 14, 2026)](https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026)
2. [Security Risk Advisors — Sangoma Switchvox SMB advisory](https://labs.sra.io/posts/switchvox/)
3. [Horizon3.ai — CVE-2026-9586: Sangoma Switchvox RCE](https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/)
4. [CVE record — CVE-2026-9586](https://www.cve.org/CVERecord?id=CVE-2026-9586)
5. [NVD — CVE-2026-9586](https://nvd.nist.gov/vuln/detail/CVE-2026-9586)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-9586](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586)
7. [BleepingComputer — Hackers exploit Sangoma Switchvox flaw to deploy reverse shells](https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/)
8. [SecurityWeek — Sangoma Switchvox Vulnerability Exploited in the Wild](https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/)

---
Source page: https://erroneo.us/security/briefs/sangoma-switchvox-cve-2026-9586-pre-auth-sqli-rce/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt