CVE-2026-9586Active Exploitation(sangoma / switchvox)

CRITICALCVSS 9.8 · CRITICALCISA KEV

Exploitation observed; activity peaked at 25 mentions and remains active

Immediate actions

Patch sangoma switchvox systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

sangoma CVEs Back to dashboard

8.3/ 10 priority

Sources & remediation

Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2026-09-05. Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Exploit / PoC references

https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#

Vendor / third-party advisories

Other references

https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026

Weakness type (CWE)

CWE-89

Priority

CRITICAL

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

DECLINING

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

switchvox

Threat summary

Active exploitation appears in 52 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
69 mentions across 13 observed days

What's happening

Active exploitation reported across 52 signals
Exploit tool or code specified in 5 signals
PoC mentioned or linked in 19 signals
Patch or workaround mentioned in 27 signals
Technical details provided in 57 signals
Disclosure: 10 classified signals
General: 4 classified signals
Peaked 11d ago at 25 mentions (2026-09-02); latest day: 2
69 total mentions across 13 days

Affected systems

Vendors

sangoma

Products

switchvox

Deep dive

Activity timeline69 mentions / 13d

Signal classification5 categories

Active Exploitation

4971.0%

Disclosure

1014.5%

General

45.8%

Patch

45.8%

PoC

22.9%

Referenced assets70 URLs

By indicator

Classification over time

Date	Total	Labels

2026-09-01	10	Active Exploitation5Disclosure2General2PoC1
2026-09-02	25	Active Exploitation19Disclosure3General2Patch1
2026-09-03	10	Active Exploitation8Disclosure1Patch1
2026-09-04	8	Active Exploitation6Disclosure2
2026-09-05	2	Active Exploitation2
2026-09-06	2	Active Exploitation2
2026-09-07	2	Active Exploitation1Patch1
2026-09-08	4	Active Exploitation1Disclosure1Patch1PoC1
2026-09-11	1	Active Exploitation1
2026-09-15	1	Disclosure1
2026-09-18	1	Active Exploitation1
2026-09-23	1	Active Exploitation1
2026-09-30	2	Active Exploitation2

Full discourse20 posts

The Hacker News@TheHackersNews45d
Active Exploitation
🛑 Attackers are exploiting Switchvox without credentials to deploy reverse shells. CVE-2026-9586 is a critical SQL injection in the /pa endpoint. About 4,000 instances are exposed online, and Sangoma has released a patch. Inside the exploit: https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html
Post summary
CVE‑2026‑9586, a critical SQL injection in Switchvox, is being actively exploited in the wild to gain reverse shells, with roughly 4,000 vulnerable instances and a patch released by Sangoma.
125175828.4K
2.4M followersView on X
Horizon3 Attack Team@Horizon3Attack46d
Disclosure
Today we are disclosing the technical details of CVE-2026-9586, a SQLi-to-RCE in #Sangoma #Switchvox which we reported in April 2026. On 30 Aug 2026, we received honeypot alerts of valid exploitation attempts across multiple internet sensors deployed in coordination with @DefusedCyber. Check out the details and IoCs in our latest blog: https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#
Post summary
The authors disclose the technical details of CVE‑2026‑9586, a SQLi‑to‑RCE vulnerability in Sangoma Switchvox, and report that valid exploitation attempts were observed by honeypot sensors.
018249209.7K
13.1K followersView on X
Cytex@cytexsmb45d
Active Exploitation
An enterprise VoIP platform is being actively exploited in the wild, with attackers executing arbitrary code as a database superuser through a single unauthenticated request. CVE-2026-9586 (CVSS: 9.3) is a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox. Attackers can execute arbitrary code as the PostgreSQL superuser. A single crafted request is enough. Attackers are deploying reverse shells and enumerating running processes. There are approximately 4,000 internet-exposed instances, mostly in the U.S. The flaw resides in the /pa endpoint, which processes XML content and concatenates user-controlled PhoneIP values directly into PostgreSQL queries. No sanitization, no parameterization. SRA Labs independently discovered the same flaw in May. They demonstrated arbitrary database operations, user record modification, privilege escalation to web administrators, and reverse shell execution, all as an unauthenticated attacker. Sangoma released patches in Switchvox and the attacker IP 176.65.148[.]184 has been flagged for port scanning and brute-force activity. Unauthenticated SQL injection in internet-exposed VoIP infrastructure is a direct path to full system compromise and lateral movement. The quick succession of exploit attempts suggests most exposed instances will be targeted. Organizations should patch immediately, audit logs for the IOC above, and treat any exposed Switchvox instance as compromised until proven otherwise. Cytex connects misconfigurations, vulnerabilities, and exposures into clear attack paths, enabling you to prioritize the risks that matter most before attackers exploit them. What is your current visibility into internet-exposed VoIP infrastructure, and how quickly can you identify and patch vulnerable instances?
Post summary
Attackers are actively exploiting CVE-2026-9586, a critical unauthenticated SQL injection in Sangoma Switchvox, enabling arbitrary code execution as the PostgreSQL superuser. Immediate patching and monitoring are urged to mitigate the rapid exploitation of approximately 4,000 exposed instances.
22043196
849 followersView on X
Horizon3.ai@Horizon3ai46d
Active Exploitation
A critical Sangoma Switchvox vulnerability discovered by Horizon3 is now being exploited in the wild. CVE-2026-9586 is an unauthenticated SQL injection that can lead to remote code execution. Here’s what defenders need to know. 🧵 https://t.co/qMUxApAErN
Post summary
CVE‑2026‑9586, a critical unauthenticated SQL injection in Sangoma Switchvox, is being actively exploited in the wild, enabling remote code execution. Defenders should act promptly although no patch or workaround is provided.
15031389
3.0K followersView on X
SecurityWeek@SecurityWeek43d
Active Exploitation
Sangoma Switchvox Vulnerabilities Exploited in the Wild - Tracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution. https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/
Post summary
CVE-2026-9586 is an unauthenticated SQL injection in Sangoma Switchvox that has been actively exploited in the wild, enabling remote arbitrary code execution. No patch or workaround information is provided in the text.
021513.2K
229.0K followersView on X
Mr.Niko@_MrNiko45d
Active Exploitation
🚨 CVE-2026-9586 hit in the wild Sangoma Switchvox: unauth SQLi → RCE on /pa ~4k boxes on Shodan. honeypots already catching real traffic. https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/ #VulnerabilityResearch #ExploitDev #InfoSec https://t.co/yIfS4Sands
Post summary
CVE-2026-9586 is actively being exploited against Sangoma Switchvox systems, with unauthenticated SQL injection leading to remote code execution; a disclosure link suggests additional technical details and potential PoC are available.
01062406
1.5K followersView on X
Help Net Security@helpnetsecurity45d
Active Exploitation
Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586) - https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/ - @Horizon3ai @DefusedCyber - #vulnerability #Sangoma #VoIP #Exploit #Cybersecurity #CyberSecurityNews #SecurityNews
Post summary
The post asserts that CVE-2026-9586 in Sangoma Switchvox is currently being exploited in the wild, though it offers no detailed technical, PoC, or patch information.
12051886
60.2K followersView on X
Ayed Alosaimi | تحليل سيبراني@Ayed_Alosaimi44d
Active Exploitation
☎️ قد يبدو سنترال الشركة الرقمي مجرد نظام للمكالمات، لكن طلبًا واحدًا مصممًا بعناية قد يمنح مهاجمًا بعيدًا القدرة على تنفيذ أوامر داخل خادمه بلا كلمة مرور. في 2 سبتمبر 2026، أدرجت CISA الثغرة CVE-2026-9586 ضمن الثغرات المستغلة فعليًا. وراء كل اختراق... قصة 👇 Switchvox من Sangoma منصة تدير هواتف الشركات والبريد الصوتي وتحويل المكالمات ومراقبتها. يقع الخلل في واجهة /pa التي تستقبل رسائل XML من الهواتف لتنفيذ بعض وظائف الإشعار. الواجهة متاحة دون مصادقة، وتعالج قيمة يرسلها الطرف الآخر بطريقة غير آمنة. يستخرج التطبيق حقل PhoneIP من الرسالة، ثم يضعه مباشرة داخل استعلام PostgreSQL دون فصل البيانات عن بنية الاستعلام. هنا يحدث حقن SQL: لا يعود الإدخال مجرد عنوان IP للهاتف، بل يصبح جزءًا من أوامر قاعدة البيانات ويُنفذ بصلاحيات مستخدم PostgreSQL الفائق. لم يتوقف الأثر عند قاعدة البيانات. أظهر الباحثون أن وظيفة في PostgreSQL تسمح بتحويل حقن SQL إلى تشغيل أوامر على النظام وفتح قناة تحكم عكسية. وفي 30 أغسطس 2026، رصدت مصائد Defused Cyber محاولات استغلال فعلية، أعقبتها أوامر مُرمّزة بـ Base64 لاستطلاع العمليات الجارية. إدراج الثغرة في KEV يعني وجود دليل على استغلالها، لكنه لا يعني أن كل خادم Switchvox مخترق. يرتفع الخطر إذا كانت الواجهة مكشوفة للإنترنت، لأن الهجوم لا يحتاج إلى حساب أو تفاعل مستخدم. وقد يصبح خادم الاتصالات موطئ قدم داخل الشبكة بحسب صلاحياته واتصالاته. الإجراء العاجل: • احصر خوادم Switchvox وإصداراتها. • حدّث إلى 8.4.0.2 أو إصدار أحدث. • امنع الوصول العام غير الضروري، واقصر الواجهة على الشبكات والعناوين الموثوقة. • راجع الاتصالات الصادرة من الخادم وراقبها. بعد التحديث، افحص /var/log/switchvox/db-quirks.log بحثًا عن آثار حقن SQL أو تشغيل أوامر، وراجع العمليات والاتصالات الصادرة. عند الاشتباه، اعزل النظام وابدأ استجابة حادثة؛ فالتحديث يغلق الثغرة، لكنه لا يزيل وصولًا سبق تثبيته. #أمن_سيبراني #VoIP #إدارة_الثغرات
Post summary
Switchvox’s exposed /pa XML endpoint permits unauthenticated SQL injection that can lead to remote code execution, with documented attacks in the wild and a vendor patch (8.4.0.2) and interface restrictions recommended.
02051917
34.9K followersView on X
Sandro Gauci@sandrogauci17d
Active Exploitation
September RTCSec newsletter: Switchvox CVE-2026-9586 exploited in the wild, a zero-click WeChat call bug from @XorNinja's team at Calif, 16 OpenSIPS advisories, and why so many advisories now come without CVEs. https://www.enablesecurity.com/newsletter/2026-09-rtcsec-news/ #VoIP #WebRTC #InfoSec
Post summary
The newsletter announces that Switchvox CVE-2026-9586 is actively exploited in the wild, alongside other security updates.
01051414
3.9K followersView on X
connect24h@connect24h46d
Active Exploitation
PBXまで侵入口にされると、さすがに笑えない。 http://Horizon3.aiは、Sangoma SwitchvoxのCVE-2026-9586について、未認証HTTP endpoint「/pa」のSQL injectionからPostgreSQLのTO PROGRAMを経てRCEに至り、honeypotで有効な悪用試行も観測したと報告。8.4.0.2で修正済みと主張している。電話基盤は止めにくい。だからこそ、露出した管理面は古いほど静かに効いてくる。ソース: https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/
Post summary
CVE-2026-9586 in Sangoma Switchvox allows unauthenticated RCE via SQL injection to the "/pa" endpoint; it has been actively exploited as seen in honeypot data, and a patch (8.4.0.2) is available.
01033576
8.3K followersView on X
International Cyber Digest@IntCyberDigest46d
General
Read: https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/
Post summary
The snippet is a reference link to an external article about CVE‑2026‑9586, with no internal details provided.
000432.8K
235.3K followersView on X
/r/netsec@_r_netsec46d
Active Exploitation
Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586 https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/
Post summary
The text announces that Sangoma Switchvox CVE‑2026‑9586 is being actively exploited and links to a disclosure that likely contains a proof of concept for the RCE vulnerability.
000521.1K
34.1K followersView on X
Total Cyber-Sec@totalcybersec45d
Active Exploitation
🚨 Cerca de 4.000 sistemas #SangomaSwitchvox están expuestos a Internet y una falla crítica ya está siendo explotada para obtener acceso remoto. CVE-2026-9586 permite #SQLInjection sin autenticación. 🔗 https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/ 🧵 Hilo #CyberSecurity 👇
Post summary
CVE‑2026‑9586 involves unauthenticated SQL injection and is reportedly being actively exploited, with a link to an external article that likely contains further exploit details.
12030263
15.8K followersView on X
Daily CyberSecurity@Daily_CyberSec46d
Active Exploitation
CVE-2026-9586, a critical Sangoma Switchvox vulnerability, is exploited in the wild, giving unauthenticated attackers SQL injection and remote code execution. #Sangoma #Switchvox #CVE20269586 #RCE #SQLInjection #VoIP #InfoSec #ExploitedInTheWild https://securityonline.info/sangoma-switchvox-cve-2026-9586-rce/ https://t.co/l0IFR374Fz
Post summary
CVE-2026-9586 in Sangoma Switchvox is a critical SQLi/RCE vulnerability that is being actively exploited in the wild.
10041518
13.0K followersView on X
Enable Security@enablesecurity17d
Active Exploitation
1/ Sangoma Switchvox is being exploited in the wild through CVE-2026-9586, the unauthenticated SQL injection fixed in 8.4.0.2 back in July. @hacks_zach's team at Horizon3 caught it in their honeypots. Upgrading doesn't clean a compromised box. September RTCSec newsletter 🧵
Post summary
Sangoma Switchvox is being actively exploited in the wild via CVE-2026-9586, an unauthenticated SQL injection vulnerability patched in version 8.4.0.2, though upgrading does not clean compromised systems.
1002185
361 followersView on X
pdnuclei-bot@pdnuclei_bot46d
Disclosure
🚨 CVE-2026-9586 - critical 🚨 Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection > Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vu... 👾 https://cloud.projectdiscovery.io/library/CVE-2026-9586 @pdnuclei #NucleiTemplates #cve
Post summary
CVE‑2026‑9586 exposes Sangoma Switchvox versions prior to 8.4.0.2 to unauthenticated SQL injection; the disclosure provides only basic technical details without exploitation or patch information.
00021590
1.3K followersView on X
Horizon3.ai@Horizon3ai46d
General
Read our full technical analysis of CVE-2026-9586: https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/?utm_source=twitter&utm_medium=social
Post summary
The tweet merely points to a website hosting a full technical analysis of CVE-2026-9586, without providing concrete details or claims about exploitation or mitigation.
11001140
3.0K followersView on X
Machina Record@MachinaRecord41d
Active Exploitation
【リンク集：週末のセキュリティ関連ニュース/記事】＜脆弱性＞・Google、Chromeのゼロデイ脆弱性を修正　今年に入って6件目（CVE-2026-85046） https://www.securityweek.com/google-patches-6th-chrome-zero-day-of-2026/ ・PostgreSQLにおける12年来の脆弱性でデータベースやサーバーの乗っ取りが可能に（CVE-2026-6471） https://www.securityweek.com/12-year-old-postgresql-vulnerability-enables-database-server-takeover/ ・Sangoma Switchvoxの脆弱性が攻撃で悪用される（CVE-2026-9586） https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/ ・Citrix NetScalerの重大な認証バイパス脆弱性が攻撃で悪用される（CVE-2026-19490） https://www.bleepingcomputer.com/news/security/hackers-target-critical-citrix-netscaler-auth-bypass-in-attacks/ ・PaperCutの欠陥が悪用される　欧米の教育機関から認証情報を盗み出す目的（CVE-2026-81578、CVE-2026-82078） https://thehackernews.com/2026/09/attackers-exploit-papercut-flaws-to.html ・VMware Workstation／Fusionの重大な欠陥により、VM管理者がホスト上でコード実行可能に（CVE-2026-59346、CVE-2026-59347） https://thehackernews.com/2026/09/critical-vmware-workstation-and-fusion.html ・パッチ未適用のTeamCity経由でJetBrainsのCadenceが侵害被害に　AWSの認証情報が盗まれる（CVE-2026-63077） https://thehackernews.com/2026/09/attackers-breached-jetbrains-cadence.html ・パッチ未適用のMagentoとAdobe Commerceのゼロデイが悪用され、オンラインストアにバックドアを仕込まれる https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html ＜マルウェア・その他脅威＞・月額料金不要のストリーミング端末SuperBox、家庭用ネットワーク通じて不正トラフィックを送信する恐れ https://www.malwarebytes.com/blog/news/2026/09/free-streaming-boxes-may-be-routing-criminal-traffic-through-your-home ・侵害されたサイト5,400件超がブロックチェーン上に保存されたClickFixペイロードを配信 https://www.bleepingcomputer.com/news/security/over-5-400-hacked-sites-serve-clickfix-payloads-stored-on-the-blockchain/ ・REVSTEALER関連モジュールが4件見つかる　WindowsアップデートやMicrosoft Defenderを無効化し、クリプトマイナーを実行 https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html ・インターネットに公開されたSSH通じ、認証なしでMikroTikルーターが乗っ取られる https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html ・新種のバックドア「Ted」が標的のHAProxyビルド内に潜伏し、Webトラフィックを傍受 https://thehackernews.com/2026/09/new-ted-backdoor-hides-inside-victims.html ＜データ侵害/サイバー犯罪＞・ShipMonkの侵害で、削除されたはずの米国人顧客6万7,000人分のデータも流出　Trezorが発表 https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html ・ベルリン市保有の情報が大量にリークされる　最も機微性の高い文書5.26TBが流出―その全貌 https://medium.com/@jankammerath/the-berlin-mega-leak-inside-the-massive-5-26-tb-leak-of-the-citys-most-sensitive-documents-ab133444d1ba ＜AI関連＞・CrowdStrike、NVIDIAと共同開発したサイバーセキュリティ向け最先端AIモデル群「SafeMind」を発表 https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-launches-frontier-models-cybersecurity-created ・OpenAIエージェント、5月にドイツの休眠サイトを不正使用　数か月後にはHugging Faceを侵害 https://www.theregister.com/ai-and-ml/2026/09/04/rogue-openai-agents-used-dead-german-web-site-to-communicate-in-may-months-before-hugging-face-incident/5294554 ＜サイバー戦/APT/国家型アクター/地政学関連＞・買い取った位置情報で米軍兵士の追跡が依然可能　議会は原因究明に努める https://www.theregister.com/public-sector/2026/09/06/us-troops-can-still-be-tracked-by-purchased-location-data-and-congress-wants-to-know-why/5294652 ＜逮捕/テイクダウン/制裁/違反/その他法執行関連＞・IDScan社、1億5,300万人分の運転免許証が流出したデータ侵害めぐり提訴される https://www.bleepingcomputer.com/news/security/idscan-sued-over-alleged-data-breach-affecting-153-million-drivers/ ・シアトル・タイムズとニューズデイ、OpenAIとマイクロソフトを提訴　他紙に続き https://techcrunch.com/2026/09/05/seattle-times-and-newsday-are-the-latest-publications-to-sue-openai-and-microsoft/ ＜リサーチ/攻撃手法/TTP＞・Tengu：Mirai型Linux／IoTボットネットの解析 https://app.reverser.space/p/duckie/tengu-reverse-engineering-a-mirai-style-linux-iot#0x1083d ・見えないUnicode文字使い、メールのフィルターを回避する大規模フィッシングキャンペーン https://cyberworldops.eu/en/million-dollar-phishing-campaign-uses-invisible-unicode-characters-to ＜その他＞・Exchange Onlineの障害でメールの送受信に遅れ　「Server busy」というエラー表示も https://www.bleepingcomputer.com/news/microsoft/exchange-online-outage-causes-email-delays-server-busy-errors/ ・G7、量子サイバー脅威への備えを急ぐよう組織に呼びかけ https://therecord.media/g7-urges-organizations-to-prepare-for-quantum-threats
Post summary
The entry list highlights multiple CVEs that are being actively exploited in the wild, with some noted patch status, but lacks explicit PoC or exploit code references.
100102.1K
1.3K followersView on X
Ryx@PadhiyarRushi41d
Active Exploitation
🚨 Sangoma Switchvox under active attack. ⚠️ Unauthenticated SQL injection → RCE (CVE-2026-9586). Attackers already dropping reverse shells. ~4,000 instances exposed online. If you run Switchvox, assume you’re in scope. https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/ #VoIP #RCE #ThreatIntel
Post summary
Sangoma Switchvox is under active exploitation with attackers leveraging an unauthenticated SQL injection that leads to RCE and dropping reverse shells on approximately 4,000 exposed instances.
00020126
953 followersView on X
Daily CyberSecurity@Daily_CyberSec43d
Active Exploitation
Switchvox CVE-2026-9586 lets an unauthenticated attacker reach a root shell via SQL injection. Active exploitation seen; patch to 8.4.0.2. #Switchvox #CVE20269586 #RCE #SQLInjection #Sangoma #VoIP #InfoSec https://meterpreter.org/switchvox-cve-2026-9586-rce/
Post summary
The post confirms CVE-2026-9586 is actively exploited in the wild, offers a PoC link, and notes a patch release.
01010478
12.9K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sangoma	switchvox	-	-	-

Explore more

Back to dashboard sangoma CVEs switchvox vulnerabilities

What researchers are saying

CVE-2026-9586

Horizon3 Attack Team[verified]@Horizon3AttackDisclosure

The authors disclose the technical details of CVE‑2026‑9586, a SQLi‑to‑RCE vulnerability in Sangoma Switchvox, and report that valid exploitation attempts were observed by honeypot sensors.

Cytex[verified]@cytexsmbActive Exploitation

Attackers are actively exploiting CVE-2026-9586, a critical unauthenticated SQL injection in Sangoma Switchvox, enabling arbitrary code execution as the PostgreSQL superuser. Immediate patching and monitoring are urged to mitigate the rapid exploitation of approximately 4,000 exposed instances.

Horizon3.ai[verified]@Horizon3aiActive Exploitation

CVE‑2026‑9586, a critical unauthenticated SQL injection in Sangoma Switchvox, is being actively exploited in the wild, enabling remote code execution. Defenders should act promptly although no patch or workaround is provided.

SecurityWeek[verified]@SecurityWeekActive Exploitation

CVE-2026-9586 is an unauthenticated SQL injection in Sangoma Switchvox that has been actively exploited in the wild, enabling remote arbitrary code execution. No patch or workaround information is provided in the text.

Mr.Niko[verified]@_MrNikoActive Exploitation

CVE-2026-9586 is actively being exploited against Sangoma Switchvox systems, with unauthenticated SQL injection leading to remote code execution; a disclosure link suggests additional technical details and potential PoC are available.

Ayed Alosaimi | تحليل سيبراني[verified]@Ayed_AlosaimiActive Exploitation

Switchvox’s exposed /pa XML endpoint permits unauthenticated SQL injection that can lead to remote code execution, with documented attacks in the wild and a vendor patch (8.4.0.2) and interface restrictions recommended.

connect24h[verified]@connect24hActive Exploitation

CVE-2026-9586 in Sangoma Switchvox allows unauthenticated RCE via SQL injection to the "/pa" endpoint; it has been actively exploited as seen in honeypot data, and a patch (8.4.0.2) is available.

International Cyber Digest[verified]@IntCyberDigestGeneral

The snippet is a reference link to an external article about CVE‑2026‑9586, with no internal details provided.