9.3 CVSS Switchvox Flaw Actively Exploited for Reverse Shells

For security operations teams, CVE-2026-9586 is not a theoretical SQL injection: it is an unauthenticated remote code execution path in an internet-facing VoIP appliance that is already being used to drop reverse shells. The exploit chain starts in the /pa endpoint, where an XML PhoneIP value is concatenated into PostgreSQL, and ends with OS command execution. If your organization runs Switchvox, this shifts from 'patch this quarter' to 'hunt now and patch immediately.'

The cybersecurity community is tracking active exploitation of CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma's Switchvox enterprise VoIP management platform. Horizon3 publicly warned on September 1, 2026, that threat actors were already exploiting the flaw in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog the following day. The flaw carries a CVSS score of 9.3. It allows a remote unauthenticated attacker to send a single crafted XML request to the /pa HTTP endpoint, where the PhoneIP field is concatenated directly into an unparameterized PostgreSQL query. That string-building error gives the attacker arbitrary SQL execution and, ultimately, operating-system command execution.

“

Horizon3 publicly warned on September 1, 2026, that threat actors were already exploiting the flaw in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog the following day.

The vulnerability is one of 12 flaws Horizon3 discovered and reported to Sangoma on April 10, 2026. Sangoma fixed all 12 in Switchvox version 8.4.0.2, released July 14, 2026. Despite the patch being available for roughly six weeks before exploitation was observed, internet-facing Switchvox deployments remained exposed. On August 30, Horizon3's honeypots recorded active exploitation from a single source IP, 176.65.148.184, in rapid succession across multiple systems. The attacker attempted to establish a reverse shell, executed an initial payload, then collected information about the top running processes on the compromised Switchvox system. That process data was exfiltrated to a remote server in base64-encoded form. Horizon3 assesses that most internet-exposed Switchvox instances 'will be or have already been targeted.'

The exploit mechanics demonstrate why SQL injection still matters. The /pa endpoint processes XML key-value pairs for phone-system notification events, such as incoming or outgoing call notifications. The PhoneIP value is extracted and concatenated into a SQL query without sanitization or parameterization. NIST's advisory states that an unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database, including database operations and remote code execution. Enterprise VoIP systems are frequently reachable from the public internet for remote offices and softphone clients, so the attack surface is substantial and easily enumerated by scanning services.

CISA's KEV update on September 2 was not limited to CVE-2026-9586. The agency added six other issues, including the JFrog Artifactory bug, two SonicWall SMA1000 zero-days recently flagged as exploited, CVE-2026-48710 in Starlette exploited since May, CVE-2026-49869 in Kestra flagged by Microsoft last week, and CVE-2026-59822 in LiteLLM observed in Wiz honeypots. For federal agencies, KEV inclusion triggers remediation obligations under CISA's binding operational directive; for private sector defenders, KEV is a practical signal that a vulnerability is being used by real adversaries, not just proof-of-concept researchers.