Sangoma Switchvox Flaw Exposes Thousands to Remote Code Execution Attacks
A critical security vulnerability in the Sangoma Switchvox VoIP platform is being actively exploited by hackers to deploy reverse shells, putting thousands of internet-exposed systems at risk. The flaw, identified as CVE-2026-9586, was discovered by security researchers at Horizon3 and reported to Sangoma back in April. Despite a patch being released on July 14, many systems remain vulnerable, making them prime targets for attackers.
Switchvox is an enterprise VoIP management platform used to configure and monitor business phone systems, often connected directly to the internet. This exposure makes it an attractive target for hackers looking to exploit vulnerabilities like CVE-2026-9586. The flaw allows unauthenticated attackers to inject malicious SQL code into Switchvox’s /pa HTTP endpoint, which can then be executed remotely to execute operating-system commands. In a demonstration, Horizon3 showed how this could be done using a simple XML request sent via the curl command.
The attack scenario plays out with the attacker attempting to establish a reverse shell on the compromised system. This involves executing an initial payload and collecting information about the top processes running on the Switchvox system. The data is then transmitted to a remote server in base64-encoded form. Horizon3’s honeypots have observed active exploitation attempts across multiple systems, with the attackers using a single source IP address (176.65.148.184).
The researchers warn that it is likely most internet-exposed Switchvox instances will be or have already been targeted. Shodan data shows approximately 4,000 devices are currently exposed on the internet, with most located within the United States. While Horizon3 has not seen active exploitation of the other 11 flaws they discovered earlier, the CVE-2026-9586 vulnerability is a pressing concern.
To mitigate this risk, system administrators should immediately upgrade to Switchvox version 8.4.0.2 or later and check for signs of having been targeted in the meantime. Signs of compromise include suspicious statements in /var/log/switchvox/db-quirks.log and network connections to the observed attacker IP, particularly on port 39323.
In a broader context, this incident highlights the importance of timely patching and monitoring for security vulnerabilities. As we’ve seen with other recent attacks, exploits can spread rapidly once a vulnerability is publicly known or exploited in the wild. By staying vigilant and taking proactive measures to secure their systems, organizations can reduce their exposure to these types of attacks.
In practical terms, this means keeping software up-to-date, monitoring system logs for suspicious activity, and implementing robust security protocols to prevent unauthorized access. While no solution can guarantee complete protection against determined attackers, a multi-layered approach to cybersecurity can significantly reduce the risk of successful breaches.
Source: Bleeping Computer — 2026-09-02