Sangoma Switchvox SQL injection CVE-2026-9586 used in attacks; fixed in 8.4.0.2
Attackers are exploiting CVE-2026-9586, a login-free SQL injection in Sangoma Switchvox business phone systems that can give them remote code execution. Sangoma fixed it in 8.4.0.2 on 14 July. Update now, and check for signs of compromise.
Update Switchvox to 8.4.0.2 or later. If you can't yet, limit network access to the Switchvox interfaces and the /pa endpoint, and have your IT provider check for signs of compromise, including odd entries in the db-quirks log. Home users have nothing to do.
What’s happening
CVE-2026-9586 is an SQL injection in the /pa web endpoint of Sangoma Switchvox, a business phone system. An attacker needs no login: one crafted request lets them run commands against the system's database and, from there, run their own code on the server. Horizon3 found it in April 2026 and reported it, with 11 other flaws, to Sangoma; Security Risk Advisors reported it independently. Sangoma fixed it in Switchvox 8.4.0.2 on 14 July 2026. Honeypots run by Horizon3 and Defused Cyber saw real attacks from 30 August. The first attacker tried reverse shells and listed running processes; later, dozens of other addresses scanned for the flaw and installed second-stage malware, at first believed to be a cryptominer. About 4,000 Switchvox systems were visible online, mostly in the US. CISA listed the flaw as exploited on 2 September. Horizon3 had not seen attacks on the other 11 flaws. Sources differ on affected versions: Sangoma's notes name 8.2.2.1, while the CVE record names SMB Edition 8.3 (build 104997) and earlier. No later update was found.
- What
- Flaw
- Affects
- Sangoma Switchvox SMB Edition business phone system
- Affected
- Switchvox SMB Edition before 8.4.0.2 (Sangoma's release notes name 8.2.2.1; the CVE record names SMB Edition 8.3, build 104997, and earlier)
- Fixed in
- Switchvox 8.4.0.2
- Since
- 2 Sept 2026
- Closed
- 2 Sept 2026
Timeline
- Wider attacks
Reports said about 4,000 Switchvox systems were exposed to the internet, mostly in the US. Attackers were downloading second-stage malware, first thought to be a cryptominer, and dozens more source addresses had joined in. CISA listed the flaw as exploited the same day.
- Wider attacks
Horizon3 and Defused Cyber honeypots began seeing real exploitation attempts. One source address tried to open reverse shells and collected a list of running processes.
- New fixFixed
Sangoma released Switchvox 8.4.0.2 (build 105309). Its release notes list fixes for CVE-2026-9586, an unauthenticated SQL injection that can lead to remote code execution, and CVE-2026-85070, an authenticated SQL injection.
Sources
- Switchvox - Release Notes Version 8.4.0.2 July 14 2026Sangoma · 14 July 2026
- Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)Help Net Security · 2 Sept 2026
- Hackers exploit Sangoma Switchvox flaw to deploy reverse shellsBleepingComputer · 2 Sept 2026