A critical vulnerability in the Sangoma Switchvox VoIP platform is being actively exploited by hackers to deploy reverse shells, potentially allowing them to take control of affected systems. The bug, identified as CVE-2026-9586, is an unauthenticated SQL injection flaw that can lead to remote code execution. According to security researchers at Horizon3, most internet-exposed Switchvox systems have already been targeted or are likely to be soon.
Sangoma Switchvox is a widely used enterprise VoIP management platform designed to configure and monitor business phone systems. The vulnerability was discovered by Horizon3 as part of an earlier report on 12 flaws in the system, which were patched in version 8.4.0.2 released on July 14. However, it appears that CVE-2026-9586 has become a prime target for hackers due to its potential for remote code execution and ease of exploitation.
The vulnerability lies in the /pa HTTP endpoint, which is exposed and parses XML messages containing specific key-value pairs. When a request is made to notify another phone system, such as for an incoming or outgoing call event, the PhoneIP field from the XML message is directly concatenated into an unparameterized SQL query. This allows hackers to inject malicious SQL code, which can then be executed remotely.
Horizon3’s honeypots detected active exploitation of CVE-2026-9586 on multiple systems in rapid succession from a single source IP address. The attackers attempted to establish reverse shells by executing initial payloads and collecting information about the top processes running on the Switchvox system. This data was then transmitted to a remote server in base64-encoded form.
Given the speed at which these exploit attempts were made, Horizon3 warns that it is likely most internet-exposed Switchvox instances will be or have already been targeted. With approximately 4,000 devices exposed online, primarily located within the United States, administrators are urged to upgrade to version 8.4.0.2 or later as soon as possible and check for signs of compromise.
Signs of having been targeted include suspicious statements in /var/log/switchvox/db-quirks.log and network connections to the observed attacker IP, particularly on port 39323. It’s essential that administrators take immediate action to protect their systems from this active threat.
Source: Bleeping Computer — 2026-09-02