{"id":"switchvox-sqli-attacks-sep-2026","category":"patch","status":"closed","title":"Sangoma Switchvox SQL injection CVE-2026-9586 used in attacks; fixed in 8.4.0.2","tldr":"Attackers are exploiting CVE-2026-9586, a login-free SQL injection in Sangoma Switchvox business phone systems that can give them remote code execution. Sangoma fixed it in 8.4.0.2 on 14 July. Update now, and check for signs of compromise.","summary":"CVE-2026-9586 is an SQL injection in the /pa web endpoint of Sangoma Switchvox, a business phone system. An attacker needs no login: one crafted request lets them run commands against the system's database and, from there, run their own code on the server. Horizon3 found it in April 2026 and reported it, with 11 other flaws, to Sangoma; Security Risk Advisors reported it independently. Sangoma fixed it in Switchvox 8.4.0.2 on 14 July 2026. Honeypots run by Horizon3 and Defused Cyber saw real attacks from 30 August. The first attacker tried reverse shells and listed running processes; later, dozens of other addresses scanned for the flaw and installed second-stage malware, at first believed to be a cryptominer. About 4,000 Switchvox systems were visible online, mostly in the US. CISA listed the flaw as exploited on 2 September. Horizon3 had not seen attacks on the other 11 flaws. Sources differ on affected versions: Sangoma's notes name 8.2.2.1, while the CVE record names SMB Edition 8.3 (build 104997) and earlier. No later update was found.","action":"Update Switchvox to 8.4.0.2 or later. If you can't yet, limit network access to the Switchvox interfaces and the /pa endpoint, and have your IT provider check for signs of compromise, including odd entries in the db-quirks log. Home users have nothing to do.","product":"Sangoma Switchvox SMB Edition business phone system","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-9586"],"tags":["sangoma","switchvox","sql-injection","voip","pbx","exploited","cisa-kev","remote-code-execution"],"affected":["Switchvox SMB Edition before 8.4.0.2 (Sangoma's release notes name 8.2.2.1; the CVE record names SMB Edition 8.3, build 104997, and earlier)"],"fixed":["Switchvox 8.4.0.2"],"matches":[],"sources":[{"kind":"advisory","title":"Switchvox - Release Notes Version 8.4.0.2 July 14 2026","url":"https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026","by":"Sangoma","date":"2026-07-14"},{"kind":"news","title":"Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)","url":"https://helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586","by":"Help Net Security","date":"2026-09-02"},{"kind":"news","title":"Hackers exploit Sangoma Switchvox flaw to deploy reverse shells","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/","by":"BleepingComputer","date":"2026-09-02"}],"started":"2026-09-02","closed":"2026-09-02","created":"2026-11-03T22:09:09.417Z","updated":"2026-11-03T22:09:09.417Z","cve_notes":[{"cve":"CVE-2026-9586","name":"Unauthenticated SQL injection in Sangoma Switchvox","what":"An SQL injection in the /pa endpoint of Sangoma Switchvox lets an attacker with no login send one crafted request, run commands against the database and then run their own code on the phone system.","severity":"critical","cvss":9.8}],"timeline":[{"at":"2026-09-02","added":"2026-11-03T22:05:25.250Z","kind":"wider-attacks","text":"Reports said about 4,000 Switchvox systems were exposed to the internet, mostly in the US. Attackers were downloading second-stage malware, first thought to be a cryptominer, and dozens more source addresses had joined in. CISA listed the flaw as exploited the same day.","url":"https://helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586","by":"Help Net Security","patch":null},{"at":"2026-08-30","added":"2026-11-03T22:05:25.250Z","kind":"wider-attacks","text":"Horizon3 and Defused Cyber honeypots began seeing real exploitation attempts. One source address tried to open reverse shells and collected a list of running processes.","url":"https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/","by":"BleepingComputer","patch":null},{"at":"2026-07-14","added":"2026-11-03T22:05:25.250Z","kind":"new-fix","text":"Sangoma released Switchvox 8.4.0.2 (build 105309). Its release notes list fixes for CVE-2026-9586, an unauthenticated SQL injection that can lead to remote code execution, and CVE-2026-85070, an authenticated SQL injection.","url":"https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026","by":"Sangoma","patch":"patched"}],"url":"https://hard.fyi/live/switchvox-sqli-attacks-sep-2026/","json":"https://hard.fyi/api/live?id=switchvox-sqli-attacks-sep-2026"}