Approximately 4,000 Sangoma Switchvox devices were visible on the internet, with most located within the United States — and one of them is now explicitly attractive to attackers. CVE-2026-9586, an unauthenticated SQL injection in the Switchvox /pa endpoint, is being actively exploited to deliver reverse shells, security researchers warn.
CVE-2026-9586: an unauthenticated SQL injection in /pa
Horizon3 identified CVE-2026-9586 as the most serious of 12 vulnerabilities it reported to Sangoma on April 10. The vendor addressed the issues in Switchvox version 8.4.0.2, released on July 14. The root cause is an unauthenticated SQL injection in the /pa HTTP endpoint: the endpoint accepts an XML message with key-value pairs and extracts the PhoneIP field. That value is concatenated directly into an unparameterized SQL query, enabling remote code execution when a crafted XML request is supplied.
Horizon3’s demonstration and observed exploitation on August 30
Horizon3 researchers demonstrated that a crafted XML request delivered via curl can exploit the SQL injection to execute operating-system commands. Their honeypots recorded real-world exploitation attempts on August 30: multiple systems were targeted in rapid succession from a single source IP address, 176.65.148.184. The attacker attempted to establish a reverse shell, executed an initial payload, then enumerated the top running processes and transmitted that information to a remote server encoded in base64.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageIndicators of compromise and what to look for
Horizon3 recommends that administrators upgrade to Switchvox 8.4.0.2 or later as soon as possible. For systems that may have been targeted already, the report names concrete indicators of compromise: suspicious statements in /var/log/switchvox/db-quirks.log and network connections to the observed attacker IP, particularly on port 39323. Horizon3 also notes it has not observed active exploitation of the other 11 flaws it reported, but emphasizes CVE-2026-9586 is actively abused.
What this means for system administrators, procurement leaders, and security teams
- System administrators: prioritize patching to Switchvox 8.4.0.2 or later immediately, and perform retrospective hunts for the specific indicators above — db-quirks.log anomalies and connections to 176.65.148.184 on port 39323.
- Procurement leaders and operations teams responsible for VoIP: inventory internet-exposed Switchvox instances (Shodan shows roughly 4,000) and consider isolating or removing public exposure until devices are patched.
- Security teams and incident responders: treat this activity as automated and opportunistic; Horizon3 observed rapid, repeated attempts across multiple honeypots, and the exploit can move from initial execution to command execution and data exfiltration (base64-encoded) quickly.
Broader defensive context and a closing observation
Horizon3 warns that “given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet-exposed Switchvox instances will be or have already been targeted.” That assessment is sharpened by a brief note about defensive measurement: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026 — cited in the same advisory — measures defenses technique by technique across 338 million simulations run in customer production environments.
With a vendor patch available since July 14 and exploitation observed on August 30 from a repeat source, the immediate choices for operators are concrete and urgent: upgrade to Switchvox 8.4.0.2, hunt logs for db-quirks.log anomalies, and check for connections to 176.65.148.184 on port 39323. With roughly 4,000 internet-visible devices and evidence of automated targeting, the practical question is simple and specific: how quickly will exposed Switchvox installations be updated or taken offline before the next scanning wave finds them?
Original reporting: https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/
