Sangoma Switchvox Under Attack: Critical SQL Injection Enables Remote Code Execution

CVE-2026-9586 Is Already Being Exploited and Requires an Immediate Response

A critical vulnerability in Sangoma Switchvox is being exploited in real-world attacks against exposed systems. Tracked as CVE-2026-9586, the flaw allows a remote, unauthenticated attacker to send a single crafted request and issue commands to the application’s PostgreSQL database.

Malicious activity was detected by Horizon3, which also published indicators of compromise to help organizations identify potential intrusions. The precise contents of these IoCs are not known, but their availability makes it advisable to incorporate them into threat-hunting activities.

CISA added CVE-2026-9586 to the Known Exploited Vulnerabilities (KEV) catalog on September 2, 2026. For U.S. federal agencies, the remediation deadline is September 5, 2026.

This is therefore not merely a theoretical vulnerability. Internet-accessible installations—especially those still running a vulnerable version—should be considered potentially compromised and subjected to forensic analysis.

CISA’s field concerning use in ransomware campaigns is set to “Unknown.” There is no confirmed link to ransomware operations, but the data does not rule one out either. CISA explicitly requires the forensic triage specified by directive BOD 26-04.

The XML Request That Turns PhoneIP Into an SQL Injection

The flaw is located in Switchvox’s /pa endpoint, which processes XML content whose root element is <PolycomIPPhone>. Within the request, the user-controlled PhoneIP value is inserted into PostgreSQL queries without adequate sanitization or parameterization.

An attacker can therefore construct an XML document in which PhoneIP contains SQL syntax. When Switchvox processes the request, the malicious content flows directly into the statement sent to the database.

The attack has particularly favorable conditions:

• it can be launched over the network;
• it requires no authentication;
• it has low complexity;
• it does not depend on user interaction;
• it can be completed with a single specially crafted request.

Arbitrary access to PostgreSQL allows an attacker to read or modify information, alter application behavior, and compromise the availability, integrity, and confidentiality of data. Under certain conditions, the attack chain can lead to remote code execution on the affected system.

The vulnerability is classified as CWE-89, concerning the improper neutralization of special elements used in an SQL command. The NVD score is CVSS 3.1 9.8, with the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A news report instead assigns the flaw a score of 9.3. The NVD advisory’s technical rating is 9.8, but the discrepancy should be kept in mind when comparing scanners, bulletins, and prioritization systems.

Which Versions to Update and Which Build to Check First

The NVD definition considers Sangoma Switchvox versions earlier than 8.4.0.2 vulnerable. The record also specifically mentions Switchvox SMB Edition 8.3, build 104997.

Version 8.4.0.2, released on July 14, 2026, is the reference version to verify for the fix. Administrators should therefore update at least to this release after checking compatibility, backups, and Sangoma’s operational guidance.

Installing the patch alone is not sufficient for exposed systems. Since CVE-2026-9586 has already been exploited, an update may close the entry point without revealing whether an attacker previously used it.

Organizations should immediately inventory all Switchvox appliances, including forgotten instances, test environments, and interfaces published through NAT or reverse proxies. If no practical mitigations are available, CISA recommends discontinuing use of the product.

No specific workarounds other than updating have been disclosed. In the absence of an official mitigation, restricting network access may reduce exposure, but it does not replace the fix or an investigation into potential compromise.

What to Look for in Logs and the PostgreSQL Database

Triage should begin with HTTP requests directed at /pa, focusing on XML payloads containing <PolycomIPPhone>. Particular attention should be paid to unusual or unexpected values associated with PhoneIP.

Key items to look for include:

• unusual requests to /pa, especially from previously unseen IP addresses;
• SQL characters and constructs within the PhoneIP value;
• PostgreSQL errors coinciding with calls to the vulnerable endpoint;
• queries inconsistent with normal Switchvox operations;
• unexpected changes to tables, users, privileges, or configurations;
• processes, files, and network connections that cannot be attributed to routine activity;
• indicators published by Horizon3.

The presence of suspicious payloads does not automatically prove that code execution occurred, but it requires correlation with application, database, operating system, and perimeter-device logs. Evidence should also be preserved before rebooting or reinstalling the appliance.

CISA requires organizations to assess the Internet exposure of every asset, apply the vendor’s mitigations, and comply with BOD 26-04 requirements. For Switchvox and other products subject to the requirement, forensic triage is part of remediation, not an optional follow-up activity.

The Same KEV Update Includes Six Other Exploited Vulnerabilities

On September 2, 2026, CISA added six other vulnerabilities to the KEV catalog alongside the Switchvox flaw. Four share the September 5, 2026 deadline:

• CVE-2026-82329, CVSS 9.8, affects JFrog Artifactory and may allow an unauthenticated attacker to obtain administrative privileges in the default configuration.
• CVE-2026-83548, CVSS 10.0, is a server-side request forgery affecting SonicWall SMA1000 appliances and can be exploited without authentication.
• CVE-2026-83549, CVSS 7.8, also affects SMA1000 and allows command injection by an attacker authenticated as an administrator.
• CVE-2026-49869, CVSS 10.0, affects Kestra OSS. A suffix check in the AuthenticationFilter component allows Basic Auth to be bypassed and arbitrary workflows to be created. Executing shell or Python plugins can turn the bypass into command execution. The NVD entry lists kestra < 1.0.45, while the description identifies 1.0.45 and 1.3.21 as fixed versions.

For these vulnerabilities, CISA also requires forensic triage, including for the two SonicWall flaws, Kestra, and Switchvox.

The other two have a deadline of September 16, 2026:

• CVE-2026-48710, CVSS 6.5, affects Starlette and several Red Hat products. A manipulated Host header can create a discrepancy between the actual HTTP path and request.url.path, bypassing controls based on the reconstructed URL. NVD lists encode starlette < 1.0.1, while the description recommends a version at least 1.0; the guidance is not fully aligned. CISA also reports possible chaining with CVE-2026-42271, which has been listed in the KEV catalog since June 8, 2026, with a deadline of June 22, 2026.
• CVE-2026-59822, CVSS 8.2, affects LiteLLM versions before 1.84.0. A forged Bearer token can trigger an OAuth2 fallback and reach MCP tools without a valid LiteLLM key. The fix is included in version 1.84.0.

Exploitation of Starlette reportedly began in May; the Kestra vulnerability was disclosed in June, while recent attempts targeting LiteLLM have been observed in honeypots. Over the past 90 days, CVE-2015-5287 and CVE-2015-3246 were also added to the KEV catalog on August 26, 2026, along with CVE-2026-34486 on August 4, 2026, involving the same Red Hat, LiteLLM, and Encode vendor ecosystems.

For Switchvox administrators, however, the priority is clear: update to at least 8.4.0.2, check exposure of the /pa endpoint, and perform forensic triage immediately. The patch closes the vulnerability. Only an investigation can determine whether it has already been used.