Full Report
Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution. The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as
Analysis Summary
# Vulnerability: Critical Unauthenticated RCE in Sangoma Switchvox
## CVE Details
- **CVE ID:** CVE-2026-9586
- **CVSS Score:** 9.3 (Critical)
- **CWE:** CWE-89 (Improper Neutralization of Special Elements used in an SQL Command / SQL Injection)
## Affected Systems
- **Products:** Sangoma Switchvox (Enterprise VoIP platform)
- **Versions:** SMB Edition 8.3 (specifically build 104997) and potentially earlier versions within the 8.3 branch.
- **Configurations:** Systems with the web interface or `/pa` endpoint exposed to the internet.
## Vulnerability Description
The flaw is an unauthenticated SQL injection vulnerability located in the `/pa` endpoint. The application processes XML content and fails to sanitize or parameterize the user-controlled `PhoneIP` value before concatenating it directly into PostgreSQL queries.
Because the backend database runs with elevated permissions, a remote attacker can execute arbitrary SQL statements. This can be leveraged to achieve Remote Code Execution (RCE) as the PostgreSQL superuser, or to escalate privileges to a Switchvox web administrator by modifying user records.
## Exploitation
- **Status:** Exploited in the wild (active exploitation observed starting August 30, 2026).
- **Complexity:** Low
- **Attack Vector:** Network (Remote)
## Impact
- **Confidentiality:** High (Full access to backend database; ability to exfiltrate cookie signing keys and session data).
- **Integrity:** High (Ability to modify user records, escalate privileges, and execute arbitrary code/reverse shells).
- **Availability:** High (Potential for full system takeover or database disruption).
## Remediation
### Patches
- **Upgrade to Switchvox Version 8.4.0.2** (Released July 14, 2026) or later.
### Workarounds
- No specific software workaround is provided; however, restricting access to the Switchvox management interface/IP address at the firewall level to trusted IPs only is a standard recommended practice.
## Detection
### Indicators of Compromise (IoC)
- **Attacker IP Address:** `176.65.148[.]184` (Reported to be scanning and deploying reverse shells).
- **Log Evidence:** On devices with SSH access enabled, check `/var/log/switchvox/db-quirks.log` for evidence of malicious SQL injection payloads.
- **Post-Exploitation Behavior:** Enumeration of running processes via Base64-encoded commands and the establishment of outbound reverse shells.
### Detection Methods
- Monitor network traffic for unusual XML POST requests to the `/pa` endpoint.
- Scan for unauthorized administrative accounts or modified web administrator records in the database.
## References
- Sangoma Release Notes: [https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026]
- Horizon3.ai Research: [https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/]
- SRA Labs Technical Disclosure: [https://labs.sra.io/posts/switchvox/]
- CVE Record: [https://www.cve.org/CVERecord?id=CVE-2026-9586]