CVE-2026-9586

What is Sangoma Switchvox?

Switchvox is Sangoma's business VoIP PBX (private branch exchange) appliance, built on Asterisk and aimed at small and mid-size businesses. PBX appliances are attractive targets: they sit on the network edge to serve remote phones, are rarely patched promptly, store call records and voicemail, and provide a trusted internal foothold — a lineage of exploitation that runs from Elastix/FreePBX campaigns through the 2023 3CX incident.

Overview

CVE-2026-9586 is an unauthenticated SQL injection (CWE-89) in Switchvox that escalates to remote code execution on the appliance with a single crafted request. It was the most serious of twelve flaws Horizon3.ai reported to Sangoma in April 2026. Exploitation in the wild began 2026-08-30 — six weeks after the patch — and CISA added it to KEV on 2026-09-02 with an accelerated 2026-09-05 deadline. NVD scores it 9.8; Horizon3 assigned 9.3.

Affected Versions

Technical Details

Switchvox exposes an unauthenticated HTTP endpoint, /pa, that processes XML messages sent by IP phones (for example call-event notifications). The PhoneIP field of that XML is concatenated directly into an unparameterized PostgreSQL query. An attacker who can reach the endpoint sends one crafted XML document — no authentication, no user interaction, low complexity — and executes arbitrary SQL against the backend database; from there, the injection escalates to arbitrary command execution on the appliance.

Discovery

Discovered in April 2026 by Horizon3.ai (reported to Sangoma 2026-04-10) and independently by Security Risk Advisors (SRA Labs). Sangoma shipped the fix in Switchvox 8.4.0.2 on 2026-07-14.

Exploitation Context

Exploitation attempts began 2026-08-30 against Horizon3's honeypots, originating from IP 176.65.148.184: crafted XML delivered via curl to drop reverse shells, followed by process enumeration with base64-encoded output exfiltrated to remote servers. Roughly 4,000 Switchvox devices are internet-exposed per Shodan, most in the United States. No threat actor has been named. Detection guidance from the researchers: review /var/log/switchvox/db-quirks.log for injection artifacts and watch for outbound connections to port 39323.

Remediation

1. Update Switchvox to 8.4.0.2 or later. Federal deadline: 2026-09-05.
2. Remove the appliance's web interfaces from the open internet — restrict /pa and admin UI reachability to trusted networks/VPN; remote phones should connect through an SBC or VPN rather than direct exposure.
3. Hunt for compromise on any exposed appliance: inspect /var/log/switchvox/db-quirks.log, look for outbound connections to port 39323 and unfamiliar IPs (including 176.65.148.184), and check for unexpected processes or scheduled tasks.
4. If compromise is suspected, rebuild the appliance from a clean image and rotate SIP credentials, admin passwords, and any integrations' API keys.
5. Apply the rest of the July 2026 Switchvox fixes — this CVE shipped alongside eleven other reported flaws.