Attackers Exploit Switchvox Flaw to Deploy Reverse Shells

CVE-2026-9586 — a critical, unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 — can let an attacker execute arbitrary code as the PostgreSQL superuser without any credentials.

What the vulnerability is and where it lives

The flaw, tracked as CVE-2026-9586 with a CVSS score of 9.3, exists in Sangoma Switchvox SMB Edition 8.3 (build 104997). According to the CVE description, the platform's /pa endpoint processes XML that begins with <PolycomIPPhone> and concatenates the user-controlled PhoneIP value directly into PostgreSQL queries "without sanitization or parameterization." That unsafe construction, CVE.org says, allows "an unauthenticated remote attacker [to] execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution."

Observed exploitation: reverse shells, encoded commands, and IOCs

Security firms report active exploitation. Horizon3.ai said CVE-2026-9586 was one of 12 distinct vulnerabilities in Switchvox reported to Sangoma in April 2026 and that it began seeing valid exploitation attempts in the wild starting August 30, 2026. The exploitation pattern described by two independent researchers involves deploying reverse shells on compromised systems, then running Base64-encoded commands to enumerate running processes.

SRA Labs, which independently discovered the vulnerability in May, wrote that as "an unauthenticated attacker, we were able to perform arbitrary database operations, including extracting database contents, modifying user records, and escalating privileges to Switchvox web administrators." SRA Labs added that it "also successfully executed arbitrary code on the server, invoking a reverse shell on the target machine."

Sangoma's response: a patched release

Sangoma issued fixes in Switchvox 8.4.0.2 on July 14, 2026. The vulnerability report and subsequent exploitation claims relate specifically to the 8.3 (104997) SMB Edition build; the vendor-supplied patch line is identified in public reporting as Switchvox 8.4.0.2.

Indicators of compromise and a traced attacker IP

• On devices with SSH access enabled, evidence of the SQL injection payload used can appear in /var/log/switchvox/db-quirks.log.
• Horizon3.ai and other observers highlighted a recurrent attacker IP: 176.65.148[.]184. That address has been flagged on VirusTotal for "conducting port scanning, brute-force, and exploitation efforts."
• Observers report rapid, repeated exploit attempts across multiple honeypots from the same source IP, and deployment of reverse shells followed by Base64-encoded enumeration commands.

What this means for technologists, affected enterprises, and adversaries

• Technologists and security teams: the immediate artifacts to check are exposure of Switchvox instances to the internet, whether a device is running 8.3 (104997), presence of entries in /var/log/switchvox/db-quirks.log on SSH-enabled devices, evidence of reverse shell activity, and connections or activity involving 176.65.148[.]184. Horizon3.ai warns there are about 4,000 internet-exposed Switchvox instances, "most of them located in the U.S."
• Affected enterprises and procurement leaders: the publicly reported patch is Switchvox 8.4.0.2 (released July 14, 2026); organizations running the SMB Edition 8.3 build should prioritize inventory and remediation and investigate whether database contents or authentication material were accessed, because SRA Labs demonstrated exfiltration of cookie signing keys that could let attackers forge authentication for arbitrary users.
• Adversaries and opportunistic attackers: public reporting documents a working exploit chain that permits unauthenticated SQL operations, privilege escalation to web administrators, and remote code execution that invokes reverse shells — a practical template for further exploitation and lateral movement.

Security researcher Zach Hanley summarized the operational risk: "Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet exposed Switchvox instances will be or have already been targeted." The record offered by Horizon3.ai and SRA Labs is specific and stark: a high-severity flaw, available patching, clear indicators of in-the-wild exploitation, and a measurable footprint of roughly 4,000 exposed installs — a combination that will demand urgent, concrete steps from owners of affected systems.

Source: https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html