Switchvox CVE-2026-9586: Unauthenticated SQL Injection Leads to RCE, Exploited in the Wild
For the enterprise telephone exchange Sangoma Switchvox, accepting a single specially crafted XML request suffices for a stranger on the internet to reach the server’s command shell. This critical vulnerability is already being probed against live systems, and the attacks swiftly swept across several of the researchers’ decoys at once.
The flaw has been designated CVE-2026-9586 and affects Switchvox, a platform for managing enterprise VoIP telephony. The attack requires neither a password, nor an account, nor any action by an employee. The vulnerability earned a score of 9.3 out of 10 under CVSS 4.0.
An Unauthenticated Endpoint Opens the Door
The entry point is the /pa HTTP address, exposed without authorization, through which the system processes notifications for telephones. Switchvox accepts XML, extracts the PhoneIP field, and inserts its contents directly into a query to PostgreSQL. For want of any validation, an attacker can perform an SQL injection and append commands of their own.
What renders the situation especially perilous is the privilege level of the database. The query executes as the PostgreSQL superuser, so the attacker can invoke the COPY TO PROGRAM function and move from SQL commands to executing operating-system commands. The researchers confirmed that a reverse command shell can be obtained through a single crafted HTTP request.
Exploitation Already Observed in the Wild
On August 30, the honeypots of Horizon3 and Defused Cyber recorded genuine exploitation attempts across several nodes at once. The requests arrived from the address 176.65.148.184. After launching the shell, the attacker gathered information about running processes and dispatched the results to a remote server. The rapid succession of identical requests led the researchers to surmise that the attackers are systematically sweeping through internet-accessible Switchvox installations.
According to Shodan, roughly 4,000 such systems are reachable online, the majority situated in the United States. Horizon3 believes that a substantial share of exposed Switchvox instances may already have fallen under automated scanning. Administrators can search for traces of injected SQL commands in the /var/log/switchvox/db-quirks.log journal.
Patch Available Since July
Sangoma closed the vulnerability back on July 14 in Switchvox 8.4.0.2. Alongside CVE-2026-9586, the vendor remedied several other problems, including command injection, local file reading, XSS, and SSRF.
The technical breakdown of the attack demonstrates that no elaborate chain is needed for a breach. Administrators of internet-accessible Switchvox systems are advised to upgrade at least to version 8.4.0.2, and separately to inspect their logs and network activity for signs of a compromise that has already occurred.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
