Attackers are already attempting to exploit a critical Sangoma Switchvox vulnerability that can enable command execution without authentication or user interaction.
Security researchers have observed active exploitation attempts targeting CVE-2026-9586, a critical SQL injection flaw in Sangoma’s Switchvox SMB business phone system. The vulnerability could allow a remote, unauthenticated attacker to execute operating system commands on an exposed Switchvox server.
For organizations running internet-facing VoIP infrastructure, that turns what might otherwise look like another patch notice into a more immediate race: Sangoma released a fix in July, but vulnerable systems are now drawing attacker attention.
Researchers catch Switchvox exploitation attempts in the wild
Horizon3 researchers disclosed the activity this week after working with Defused Cyber to deploy Switchvox honeypots.
Horizon3 reported the security issues to Sangoma on April 10, and Sangoma acknowledged the report the same day. On April 21, Sangoma provided Horizon3 with a pre-release build containing validation fixes. The company ultimately released Switchvox 8.4.0.2 on July 14.
Then, on Aug. 30, Defused Cyber’s honeypots detected what Horizon3 described as valid attempts to exploit CVE-2026-9586 in the wild.
The vulnerability lies in an unauthenticated HTTP endpoint,/pa, that Switchvox uses to process phone notification requests. According to Horizon3, attacker-controlled PhoneIP input is concatenated directly into an unparameterized PostgreSQL query.
That creates an SQL injection vulnerability, but the potential impact goes far beyond that. Researchers demonstrated that the flaw can ultimately be exploited to run operating system commands on the Switchvox host.
CVE-2026-9586 carries a CVSS 4.0 score of 9.3, or critical, according to Horizon3.
The vulnerability resembles a broader class of flaws in which internet-facing administrative systems become particularly dangerous when attackers need little or no authentication. eSecurityPlanet recently covered a critical GitLab vulnerability that researchers said could be exploited without credentials, while a separate cPanel vulnerability raised the risk of server compromise through an authentication bypass.
About 4,000 Switchvox systems appear exposed
The scale of the potential attack surface is another reason administrators should pay attention.
Horizon3 said a Shodan search showed approximately 4,000 Switchvox devices exposed to the internet, with most located in the United States. An exposed system is not necessarily vulnerable or compromised, but internet access allows attackers to probe servers that have not been updated.
In the activity observed by Horizon3 and Defused Cyber, the attacker attempted to use PostgreSQL command execution to invoke nc, then used curl to send information about running processes to attacker-controlled infrastructure.
Security teams with SSH access can also check Switchvox’s /var/log/switchvox/db-quirks.log for evidence of injected SQL statements, according to Horizon3. Investigators should correlate suspicious commands with requests to the vulnerable /pa endpoint, injected PostgreSQL statements, outbound connections, and other host or network telemetry before concluding a system was compromised.
The situation reinforces the shrinking window organizations increasingly have between vulnerability disclosure and attempted exploitation. That pressure has also appeared in recent attacks against infrastructure products, including an actively exploited Cisco ASA and FTD flaw that prompted administrators to prioritize patches for exposed firewalls.
What Switchvox admins need to do now
Organizations running Sangoma Switchvox should treat this as a priority patching issue, particularly if the system is reachable from the public internet.
Administrators should:
- Upgrade to Switchvox 8.4.0.2 or later. Sangoma’s release notes list CVE-2026-9586 as one of the security issues fixed in the July 14 update.
- Check whether the system is internet-exposed. Horizon3 found roughly 4,000 Switchvox devices visible online, making externally reachable systems the most obvious targets for exploitation attempts.
- Review /var/log/switchvox/db-quirks.log for suspicious activity. Horizon3 says evidence of injected SQL statements can appear in this log. Teams should correlate suspicious entries with requests to /pa and other network or host activity.
- Look for signs of command execution. Teams should review host and network telemetry for suspicious commands and outbound connections associated with requests to the vulnerable /pa endpoint.
- Do not rely on an older-version assumption. Public sources disagree on the affected-version range. Sangoma’s release notes describe CVE-2026-9586 as affecting Switchvox 8.2.2.1, while the CNA record specifies Switchvox SMB Edition 8.3, build 104997, through earlier versions before 8.4.0.2. Horizon3 recommends that organizations running earlier releases upgrade to the fixed version rather than assume an older release is unaffected.
Security Risk Advisors, which independently discovered the flaw, also recommends upgrading Switchvox SMB systems to version 8.4.0.2 or later.
If administrators find evidence that exploitation may have succeeded, they should treat the affected Switchvox server as potentially compromised and move into their normal incident-response process rather than stopping at the patch.
The important point is timing. Sangoma released the fix on July 14, roughly six weeks before researchers detected exploitation attempts in the wild on Aug. 30. Organizations that have not yet updated still have a clear next step: patch first, then check whether attackers got there before you did.
Related reading: For another critical server-side threat, see how public exploits for WordPress flaws are raising the risk of remote code execution on unpatched systems.