GoKawiilAttackers actively exploit critical SQL injection flaw in Sangoma Switchvox VoIP systems
Security firm Horizon3 says hackers are exploiting CVE-2026-9586, an unauthenticated SQL injection bug in Sangoma Switchvox's /pa endpoint that allows remote code execution. Honeypot data shows a single source IP rapidly hitting multiple exposed systems, deploying reverse shells and exfiltrating process data. Sangoma patched the flaw, one of 12 reported by Horizon3, in version 8.4.0.2 released July 14.
GoKawiil's interpretation of the reporting above, not reported fact.
Switchvox manages enterprise phone systems, so a remote code execution flaw could let attackers pivot into business networks or eavesdrop on communications. The rapid, automated nature of the attacks suggests broad scanning campaigns rather than targeted intrusions, meaning any unpatched, internet-exposed instance is at real risk. Organizations that delay patching after a vulnerability is disclosed often become easy targets once exploit code circulates.
- CVE-2026-9586 is an unauthenticated SQL injection flaw enabling remote code execution on Switchvox systems.
- Active exploitation began August 30, with attackers deploying reverse shells and stealing process data.
- Sangoma released a fix in version 8.4.0.2 on July 14; unpatched internet-facing systems remain at high risk.
Ubiquiti UniFi Dream Machine Pro — When VoIP servers like Switchvox get hammered by unauthenticated exploits, keeping management interfaces off the open internet is the first line of defense. The UniFi Dream Machine Pro combines a security gateway, firewall and VPN server so admins can segment phone systems onto isolated VLANs and reach them remotely without exposing an HTTP endpoint. It's a solid backbone for a small business network that needs real control over what faces the outside world.
See Ubiquiti UniFi Dream Machine Pro on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-02
Published there as: “Hackers exploit Sangoma Switchvox flaw to deploy reverse shells”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.