Attackers are currently exploiting the CVE-2026-9586 security vulnerability in Sangoma Switchvox, a platform for managing voice-over-IP communications systems, with attempts to identify systems and establish reverse shells on them. According to security researchers at Horizon3, most Switchvox systems directly accessible from the internet have either already been targeted or are likely to be targeted soon.
Organizations use Switchvox to configure and monitor telephone systems. CVE-2026-9586 is the most serious of 12 vulnerabilities discovered by Horizon3 and reported to Sangoma on April 10, before the company addressed them in version 8.4.0.2, released on July 14.
How Can the Vulnerability Be Exploited?
The issue lies in an unauthenticated SQL injection vulnerability in the /pa endpoint, which can be accessed via HTTP. This endpoint receives an XML message containing pairs of values, then extracts the PhoneIP field and inserts it directly into a SQL query that does not use parameterization.
Researchers demonstrated that an attacker can send a specially crafted XML request, using the curl tool, to exploit the injection and execute commands on the operating system. Thus, the issue is not limited to exposing database data; it may also provide the attacker with a path to remote command execution on the device running Switchvox.
Attempts to Establish Reverse Shells Observed
On August 30, Horizon3 honeypots detected active exploitation attempts against several systems over a short period from a single IP address, 176.65.148.184. The attacker attempted to establish a reverse shell, then executed an initial payload and collected information about the processes consuming the most resources or showing the most activity on the Switchvox system. The data was then sent to a remote server in an encrypted format using Base64.
Horizon3 says that the rapid sequence of attempts across several honeypots from the same source suggests that most Switchvox instances exposed to the internet may be targeted. Shodan data shows approximately 4,000 internet-connected devices, most of them located in the United States. Researchers have not yet observed active exploitation of the other 11 vulnerabilities they discovered.
What Should Operators Do?
Horizon3 recommends that system administrators upgrade to Switchvox 8.4.0.2 or later as soon as possible and inspect systems for indicators of previous targeting. The indicators mentioned include suspicious strings in the /var/log/switchvox/db-quirks.log file, as well as network connections to the observed IP address, particularly over port 39323.
Why Does This Matter?
The significance of this development lies in the combination of three factors: the vulnerability requires no authentication, can be exploited remotely, and has moved from disclosure and remediation to actual exploitation. In practice, installing the patched version alone is not sufficient for organizations whose systems were exposed; Horizon3's observations also indicate the need to examine logs and outbound connections to determine whether the attacker executed commands or collected information before the update.