Sangoma Switchvox flaw exploited in active attacks

Attackers are actively exploiting a critical vulnerability in Sangoma's Switchvox VoIP platform, according to security researchers at Horizon3. The flaw, tracked as CVE-2026-9586, is an unauthenticated SQL injection that can lead to remote code execution, and Horizon3 warns that most internet-exposed Switchvox systems have likely already been targeted or will be soon.

A severe flaw in a VoIP management hub

Switchvox is an enterprise VoIP management platform used to configure and monitor business phone systems. The vulnerability sits in its /pa HTTP endpoint, which is exposed and parses XML messages containing key-value pairs. When /pa receives a request to notify another phone system—such as for an incoming or outgoing call event—it extracts the PhoneIP field from the XML message and directly concatenates its value into an unparameterized SQL query. This flaw allows an attacker to execute operating-system commands remotely by sending a crafted XML request, as demonstrated by the researchers using the curl command.

CVE-2026-9586 is the most serious of 12 flaws Horizon3 discovered and reported to Sangoma on April 10. The vendor fixed them in Switchvox version 8.4.0.2, released on July 14. Horizon3 notes that it has not seen active exploitation of the remaining 11 flaws.

Honeypots catch real-world attacks

On August 30, Horizon3's honeypots observed active exploitation on multiple systems in rapid succession from a single source IP address (176.65.148.184). The attacker attempted to establish a reverse shell, executing an initial payload and then collecting information about the top processes running on the Switchvox system. The data was then transmitted to a remote server in base64-encoded form.

“Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet-exposed Switchvox instances will be or have already been targeted,” Horizon3 warns.

— Horizon3, security research firm

The scope of exposure

Horizon3's warning points to a substantial attack surface. “Currently Shodan shows that there are approximately 4,000 devices on the internet, with most located within the United States,” the researchers note. This figure underscores the urgency for administrators running Switchvox to determine whether their systems are exposed and vulnerable.

The single-source IP activity, hitting multiple honeypots in quick succession, suggests an automated or highly organized campaign rather than a one-off attempt. The attackers' behavior—collecting process information and sending it off in base64—indicates an interest in reconnaissance, likely to understand the environment before moving further.

Recommended actions for administrators

Horizon3 strongly recommends that system administrators upgrade to Switchvox version 8.4.0.2 or later as soon as possible. In the meantime, they should check for signs of having been targeted. Indicators of compromise include suspicious statements in /var/log/switchvox/db-quirks.log and network connections to the observed attacker IP, particularly on port 39323.

For those who cannot immediately patch, Horizon3's findings suggest that any exposed instance should be treated as potentially compromised. The attack chain—SQL injection to RCE—means a successful exploit could give an attacker full control of the VoIP system, which could then be used to pivot into the broader network.

The challenge of post-breach detection

The exploitation of CVE-2026-9586 highlights a broader issue: detecting attackers after they gain valid credentials. A related report, The Blue Report 2026, notes that once attackers have valid credentials, only 37% of their actions are blocked. This statistic, based on 338 million simulations in customer production environments, suggests that techniques like SQL injection that lead to credential theft or direct access can bypass many traditional defenses.

For Switchvox administrators, the practical takeaway is that patching is not just a best practice but an urgent necessity. The window between patch release and active exploitation—less than two months—shows how quickly attackers move once a vulnerability is known.

Why this matters for your phone system

This incident is a reminder that VoIP systems are critical infrastructure, often connected to the internet and running outdated software. A compromise of a Switchvox instance could mean not just a breached phone system but a foothold into the corporate network. The fact that attackers are actively targeting these systems—and that most exposed devices may already be compromised—suggests that administrators should assume compromise until proven otherwise.

The takeaway is clear: if your organization runs Switchvox, patch to version 8.4.0.2 or later immediately. Then check for signs of intrusion, especially any connections to the attacker's IP address. The cost of inaction could be far greater than the effort of a quick update.