Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
CVE-2026-9586 is a critical (CVSS 9.3) unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 that enables remote code execution as the PostgreSQL superuser without any credentials The flaw exists in the /pa endpoint, which processes XML content and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization Threat actors began actively exploiting the vulnerability in the wild starting August 30, 2026, deployi
Analysis
TL;DR
- CVE-2026-9586 is a critical (CVSS 9.3) unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 that enables remote code execution as the PostgreSQL superuser without any credentials
- The flaw exists in the /pa endpoint, which processes XML content and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization
- Threat actors began actively exploiting the vulnerability in the wild starting August 30, 2026, deploying reverse shells and exfiltrating cookie signing keys to forge authentication material
- Approximately 4,000 internet-exposed Switchvox instances exist, primarily in the U.S., and are likely already targeted or will be targeted by attackers
- Sangoma released a patch in Switchvox 8.4.0.2 on July 14, 2026, but many organizations have yet to apply it
Why It Matters
This vulnerability represents a severe threat to enterprise VoIP infrastructure, as unauthenticated attackers can achieve full system compromise with a single crafted request—no credentials required. The active exploitation in the wild, combined with the large attack surface of 4,000 exposed instances, makes this an urgent priority for security teams managing Switchvox deployments.
Technical Details
- Vulnerability: CVE-2026-9586, CVSS score 9.3, affecting Sangoma Switchvox SMB Edition 8.3 (build 104997)
- Root Cause: The /pa endpoint processes XML content beginning with
<PolycomIPPhone>and directly concatenates the user-controlledPhoneIPvalue into PostgreSQL queries without any sanitization or parameterized query practices - Impact Chain: Attackers can execute arbitrary SQL statements, extract database contents, modify user records, escalate privileges to web administrators, exfiltrate the cookie signing key, and achieve remote code execution via reverse shells
- Exploitation Evidence: Attackers from IP 176.65.148.184 (flagged on VirusTotal for port scanning, brute-force, and exploitation) deploy reverse shells and run Base64-encoded commands to enumerate processes; SQL injection payloads are visible in
/var/log/switchvox/db-quirks.logon devices with SSH access enabled - Discovery & Patch: Independently discovered by Horizon3.ai (April 2026) and Security Risk Advisors Labs (May 2026); patched in Switchvox 8.4.0.2 released July 14, 2026
Industry Insight
- Organizations running Switchvox SMB Edition 8.3 must immediately patch to version 8.4.0.2 or later; unpatched instances exposed to the internet are highly likely to have already been compromised
- Security teams should audit logs for the identified IOCs (attacker IP 176.65.148.184, SQL injection payloads in db-quirks.log) and rotate cookie signing keys on any potentially affected systems
- This case underscores the critical importance of parameterized queries and input sanitization in web applications, particularly for internet-facing services handling sensitive authentication data
Disclaimer: The above content is generated by AI and is for reference only.