Full Report
Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]
Analysis Summary
# Morning News Roll-up 2026-09-02
## Overview
Threat actors are actively exploiting a critical unauthenticated SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox VoIP systems to achieve remote code execution and deploy reverse shells.
## Top Stories
### Hackers Exploit Sangoma Switchvox Flaw to Deploy Reverse Shells
- Summary: Attackers are targeting the `/pa` HTTP endpoint of Sangoma Switchvox systems. By sending crafted XML messages, they exploit an unparameterized SQL query to execute OS commands. Horizon3 researchers have observed active exploitation from a single IP address attempting to establish reverse shells and exfiltrate process data via base64 encoding. Approximately 4,000 devices are currently exposed on the internet.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/
### Critical RCE Vulnerability CVE-2026-9586 Disclosed
- Summary: A critical vulnerability in Sangoma Switchvox (CVE-2026-9586) allows for unauthenticated remote code execution. The flaw stems from the improper handling of the `PhoneIP` field within XML messages processed by the system's notification endpoint. While Sangoma released a patch in July (version 8.4.0.2), honeypot data indicates a surge in exploitation attempts against unpatched systems.
- Source: hxxps://horizon3[.]ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/
### Security Posture: Prevention Drops After Credential Compromise
- Summary: The Blue Report 2026 highlights that once attackers obtain valid credentials, only 37% of their subsequent actions are blocked by security defenses. This underscores the importance of patching initial access vulnerabilities like CVE-2026-9586 to prevent attackers from gaining the foothold necessary to utilize legitimate credentials for lateral movement.
- Source: hxxps://hubs[.]li/Q04sB3fb0
---
# Sangoma Switchvox Remote Code Execution (CVE-2026-9586)
## Key Points
- **Vulnerability Type:** Unauthenticated SQL Injection leading to Remote Code Execution (RCE).
- **Current Status:** Under active exploitation as of late August 2026.
- **Mechanism:** The `/pa` HTTP endpoint fails to parameterize the `PhoneIP` field in XML messages, allowing for direct command injection into SQL queries.
- **Scale:** Approximately 4,000 Switchvox devices are exposed on the internet, primarily in the United States.
- **Impact:** Attackers can gain full control over the VoIP management platform, establish reverse shells, and exfiltrate system data.
## Threat Actors
- **Attribution:** Unknown; currently identified by a single source IP address (176[.]65[.]148[.]184).
- **Behaviors:** Rapid, automated scanning and exploitation of multiple honeypots in quick succession.
- **Motivation:** Likely initial access brokering or surveillance, given the collection of process information.
## TTPs
- **SQL Injection:** Exploiting unparameterized queries in the `/pa` endpoint.
- **Command Injection:** Using SQL injection to execute OS-level commands (e.g., via `curl`).
- **Reverse Shells:** Attempting to establish persistent outbound connections to attacker-controlled infrastructure.
- **Data Exfiltration:** Collecting `top` process data and encoding it in Base64 for transmission.
- **Tooling:** Use of `curl` for initial payload delivery.
## Affected Systems
- **Platform:** Sangoma Switchvox enterprise VoIP management platform.
- **Versions:** All versions prior to **8.4.0.2**.
- **Exposure:** Systems with the management interface or `/pa` endpoint exposed to the public internet.
## IoCs
- **Attacker IP:** 176[.]65[.]148[.]184
- **Suspicious Port:** 39323 (associated with reverse shell attempts)
- **Log Files:** Look for suspicious SQL statements in `/var/log/switchvox/db-quirks.log`.
## Mitigations
- **Patching:** Immediately upgrade to Sangoma Switchvox version **8.4.0.2** or later.
- **Network Security:** Restrict access to the Switchvox management interface and endpoints to authorized IP addresses only; avoid direct internet exposure.
- **Monitoring:** Monitor network logs for outbound connections to the identified attacker IP and port 39323.
- **Audit:** Review `/var/log/switchvox/db-quirks.log` for evidence of historical exploitation attempts.
## Conclusion
CVE-2026-9586 represents a critical risk to organizations using Sangoma Switchvox. The ease of exploitation (unauthenticated RCE) and the speed at which attackers are scanning the 4,000 known exposed devices necessitate immediate patching. Organizations should assume that any internet-facing Switchvox system running a version older than 8.4.0.2 has likely been scanned or targeted.