Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
A critical, unauthenticated SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox allows attackers to execute arbitrary code and deploy reverse shells without needing credentials. The vulnerability is actively being exploited in the wild, with approximately 4,000 exposed instances primarily located in the U.S., and researchers are observing valid exploitation attempts. Sangoma released a patch in July 2026.
A critical security vulnerability, CVE-2026-9586 (CVSS score: 9.3), exists in Sangoma Switchvox, an enterprise VoIP platform. Specifically, the /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. This allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database, including database operations and remote code execution. Security Risk Advisors (SRA) Labs independently discovered and reported the vulnerability in May 2026, and has since observed valid exploitation attempts in the wild starting August 30, 2026.
SRA Labs demonstrated the vulnerability's capabilities, successfully performing arbitrary database operations, extracting database contents, modifying user records, and escalating privileges to Switchvox web administrators. They also executed arbitrary code on the server, invoking a reverse shell on the target machine. Notably, successful exploitation enables an attacker to exfiltrate the cookie signing key to an external server, facilitating the forging of authentication material for arbitrary users.
Researchers are observing exploitation efforts targeting honeypots, involving the deployment of reverse shells on compromised systems, followed by running Base64-encoded commands to enumerate running processes. Indicators of compromise include evidence of the SQL injection payload in the /var/log/switchvox/db-quirks.log file, and the attacker IP address 176.65.148[.]184, which has been flagged on VirusTotal for conducting port scanning, brute-force, and exploitation efforts. Sangoma released a patch for the flaw in Switchvox 8.4.0.2 on July 14, 2026.