Switchvox Under Attack: Critical SQL Injection Installs Reverse Shell Without Credentials

Malicious actors are exploiting CVE-2026-9586, a critical vulnerability in Sangoma Switchvox SMB Edition that allows attackers to compromise the server with a single request, without authentication.

Horizon3.ai detected valid exploitation attempts starting on August 30, 2026. Attacks observed on honeypots did not stop at checking whether the flaw was present: they installed reverse shells and executed Base64-encoded commands to enumerate running processes.

The vulnerability has a CVSS score of 9.3 out of 10, and a fix is already available. Administrators managing Switchvox systems exposed to the Internet should treat both patching and compromise assessment as urgent priorities.

Which Switchvox Versions Are Vulnerable

CVE-2026-9586 affects Sangoma Switchvox SMB Edition 8.3 (104997). The official CVE record identifies all releases from that version up to, but not including, 8.4.0.2 as vulnerable.

The fixed version is therefore:

• Switchvox SMB Edition 8.4.0.2

Sangoma released this version on July 14, 2026. The CVE was then made public on July 17, 2026, with no further updates recorded after that date.

Updating is the official mitigation currently available. No specific workarounds have been documented that can neutralize the vulnerability while keeping an earlier version in production.

Horizon3.ai estimates that approximately 4,000 Switchvox instances are directly reachable from the Internet, most of them in the United States. The figure is not confirmed by CVE or NVD records, but it provides an indication of the potential exposed attack surface.

For an enterprise VoIP system, the consequences can extend well beyond telephony. Switchvox can provide access to the database, the administrative interface, and the underlying application server.

The PhoneIP Input Reaches PostgreSQL Queries

The vulnerability is located in the /pa endpoint, which processes initial XML content containing the <PolycomIPPhone> element.

During this processing, the client-controlled PhoneIP value is inserted directly into queries sent to the PostgreSQL database. The application does not apply adequate sanitization and does not correctly use parameterized queries.

An attacker can therefore craft a request that alters the SQL syntax expected by the application. No credentials, existing session, or user interaction are required.

With a single crafted request, an attacker can:

• execute arbitrary SQL statements;
• read or modify stored data;
• manipulate accounts and privileges;
• move from database access to code execution on the server.

Horizon3.ai reports that the code can be executed with PostgreSQL superuser privileges. This specific privilege level does not appear in the available NVD and CVE information, which nevertheless confirms the possibility of achieving remote code execution.

The assigned classification is CWE-89, relating to the improper neutralization of special elements used in an SQL command. The CNA responsible for the record is Security Risk Advisors.

The full vector is:

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

The CVSS 4.0 rating describes a network-based attack with low complexity and no technical prerequisites, privileges, or victim interaction. The effects on the vulnerable system are high in terms of confidentiality, integrity, and availability.

From Database Extraction to Forged Sessions

Researchers from Security Risk Advisors Labs demonstrated a compromise chain that goes far beyond simply abusing database queries.

Using CVE-2026-9586, they extracted PostgreSQL contents, modified user records, and obtained privileges equivalent to those of Switchvox Web administrators. They also executed arbitrary code and opened a reverse shell on the target machine.

Another attack scenario involves the key Switchvox uses to sign session cookies. The vulnerability allows an attacker to steal the key and transfer it to an external server.

Once the key has been obtained, an attacker can create seemingly valid authentication material for arbitrary users. Simply changing passwords may therefore be insufficient after a compromise: the integrity of the signing key and existing sessions must also be verified.

Attacks intercepted by honeypots show that these capabilities are not merely theoretical. The payloads attempted to install reverse shells, creating a persistent or interactive remote channel to the compromised system.

Base64-encoded commands intended to enumerate processes were also observed. Encoding is not encryption, but it can make command analysis less immediate in logs or in controls based on simple text matching.

Indicators to Look for on Exposed Systems

One of the addresses associated with the observed attempts is:

176.65.148[.]184

The IP address has also been flagged on VirusTotal for port scanning, brute-force activity, and vulnerability exploitation. It should not be treated as a comprehensive indicator: other attackers may use different infrastructure.

On devices with SSH access enabled, traces of the SQL payloads can be searched for in:

/var/log/switchvox/db-quirks.log

Administrators should examine at least the following:

1. unusual requests to the /pa endpoint;
2. suspicious XML content associated with <PolycomIPPhone>;
3. unusual values or SQL syntax in the PhoneIP parameter;
4. connections to or from 176.65.148[.]184;
5. unexpected shells, processes, or services launched by the server;
6. Base64-encoded commands, particularly those associated with process enumeration;
7. recent unauthorized changes to accounts or administrative privileges;
8. outbound connections inconsistent with the normal operation of the PBX;
9. possible access, export, or replacement of the cookie-signing key.

The rapid appearance of the same IP address against multiple honeypots indicates automated activity. According to researcher Zach Hanley, many publicly reachable instances have likely already been scanned or may be scanned soon.

The absence of a connection to the known IP does not prove that a system is clean. The investigation should cover the application, database, administrative accounts, operating-system processes, and network traffic.

Patching Is Not Enough If Exploitation Has Already Succeeded

The first step is to immediately upgrade Switchvox to 8.4.0.2. All installations from 8.3 (104997) through releases preceding the fix should be treated as vulnerable.

Unpatched instances directly accessible from the Internet should receive the highest priority. If the update cannot be applied immediately, and no documented workaround is available, public exposure should at least be reduced through network controls consistent with operational requirements.

Incident response remains necessary after the patch is installed. The fix prevents new exploitation through the vulnerability, but it does not remove reverse shells, modified accounts, or other changes already introduced.

If suspicious indicators are found, the system should be isolated, logs preserved, and database integrity verified. Web administrators, active sessions, and the key used to sign cookies must also be checked.

The available data does not indicate that CVE-2026-9586 has been added to CISA’s Known Exploited Vulnerabilities catalog, nor does it list a federal remediation deadline. There is also insufficient information to link this case to other recent KEV additions involving Sangoma.

The absence of a documented CISA deadline does not reduce the technical urgency. Exploitation has been observed in the wild and can lead to code execution without credentials. For exposed installations, CVE-2026-9586 should be handled as a potential compromise, not as a merely theoretical vulnerability.