Sangoma Switchvox Hit by In-the-Wild Exploitation via Unauthenticated SQL Injection Flaw
Security researchers have detected active exploitation of a critical remote code execution vulnerability, tracked as CVE-2026-9586, affecting internet-exposed Sangoma Switchvox enterprise VoIP systems. The flaw was initially discovered by researchers at Horizon3.ai and Security Risk Advisors alongside 11 other vulnerabilities, subsequently receiving patches in Switchvox version 8.4.0.2. The underlying vulnerability resides within the unauthenticated `/pa` HTTP endpoint, which is processed by the Perl-based `PhoneAppsHandler.pm` component. This endpoint parses XML-formatted phone notification payloads, verifying only whether the request begins with expected tags like `<PolycomIPPhone>` without properly sanitizing internal fields. During processing, the application utilizes `XML::Simple::XMLin()` to extract the `PhoneIP` field and directly concatenates it into an unparameterized SQL statement enclosed in single quotes. Because database operations execute under PostgreSQL superuser privileges, malicious actors can terminate the intended query and append arbitrary backend database commands to achieve remote system command execution. Defenders monitoring honeypot networks observed opportunistic, internet-wide scanning deploying reverse shells via tools like Netcat, followed immediately by base64-encoded reconnaissance of running processes. Subsequent activity from multiple sources has expanded beyond initial probing into automated secondary payloads, including cryptocurrency mining installations. Shodan telemetry estimates roughly 4,000 Switchvox deployments remain directly exposed to the public internet, predominantly in the United States. Administrators with appliance access can inspect `/var/log/switchvox/db-quirks.log` for anomalous query delimiters, shell invocations, or commands like `COPY ... TO PROGRAM`. Organizations are strongly advised to apply version 8.4.0.2 immediately, restrict access to the `/pa` interface, and treat any unpatched public-facing instance as compromised.
Read more about Sangoma Switchvox Hit by In-the-Wild Exploitation via Unauthenticated SQL Injection Flaw