Sangoma Switchvox Hit by In-the-Wild Exploitation via Unauthenticated SQL Injection Flaw
Security researchers have detected active exploitation of a critical remote code execution vulnerability, tracked as CVE-2026-9586, affecting internet-exposed Sangoma Switchvox enterprise VoIP systems. The flaw was initially discovered by researchers at Horizon3.ai and Security Risk Advisors alongside 11 other vulnerabilities, subsequently receiving patches in Switchvox version 8.4.0.2. The underlying vulnerability resides within the unauthenticated `/pa` HTTP endpoint, which is processed by the Perl-based `PhoneAppsHandler.pm` component. This endpoint parses XML-formatted phone notification payloads, verifying only whether the request begins with expected tags like `<PolycomIPPhone>` without properly sanitizing internal fields. During processing, the application utilizes `XML::Simple::XMLin()` to extract the `PhoneIP` field and directly concatenates it into an unparameterized SQL statement enclosed in single quotes. Because database operations execute under PostgreSQL superuser privileges, malicious actors can terminate the intended query and append arbitrary backend database commands to achieve remote system command execution. Defenders monitoring honeypot networks observed opportunistic, internet-wide scanning deploying reverse shells via tools like Netcat, followed immediately by base64-encoded reconnaissance of running processes. Subsequent activity from multiple sources has expanded beyond initial probing into automated secondary payloads, including cryptocurrency mining installations. Shodan telemetry estimates roughly 4,000 Switchvox deployments remain directly exposed to the public internet, predominantly in the United States. Administrators with appliance access can inspect `/var/log/switchvox/db-quirks.log` for anomalous query delimiters, shell invocations, or commands like `COPY ... TO PROGRAM`. Organizations are strongly advised to apply version 8.4.0.2 immediately, restrict access to the `/pa` interface, and treat any unpatched public-facing instance as compromised.
Commentary
VoIP infrastructure often lands in a dangerous architectural blind spot: it requires broad external connectivity to handle phone registration, SIP signaling, and remote workers, but it routinely runs legacy codebases with excessive internal privileges. In this case, passing user input directly into unparameterized SQL queries while connected as the PostgreSQL superuser provides attackers a direct, trivial bridge straight to underlying OS execution. Any organization hosting on-premises or cloud-exposed Sangoma Switchvox instances—particularly SMBs relying on it for unified communications—is directly at risk. Threat actors are running automated scans, meaning exposed instances are likely already backdoored with reverse shells or mining software. Remediation should not stop at applying the 8.4.0.2 patch. Telephony servers act as highly capable internal pivot points with direct access to local subnets, VLANs, and potentially stored integration credentials. Security teams must isolate VoIP management planes behind a VPN or reverse proxy that explicitly drops untrusted calls to administrative and notification endpoints like `/pa`. Furthermore, defenders should pull host-level logs, review `/var/log/switchvox/db-quirks.log` for SQL-driven shell executions, and audit egress firewall logs for anomalous outbound connections over non-standard ports.
The Quote to Remember
“The Switchvox appliance is likely most valuable as a pivot point into organizations from external into internal networks. It is possible some appliances hold integration secrets that may allow them to pivot with stolen credentials”
“Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet-exposed Switchvox instances will be or have already been targeted”