An Auto-Provisioning Endpoint Built for Phones, Abused for Shells
Attackers are actively exploiting CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox, a widely deployed business VoIP/PBX platform, to plant reverse shells on internet-facing appliances.
The flaw lives in the /pa endpoint — built to handle auto-provisioning requests from Polycom IP phones. The handler accepts unauthenticated XML POST requests, and when the document root is <PolycomIPPhone>, it extracts the PhoneIP attribute and concatenates it directly into a raw PostgreSQL query instead of using a parameterized query. That lets an attacker inject arbitrary SQL, and ultimately execute OS commands with the privileges of the PostgreSQL superuser — no credentials required.
CVE-2026-9586 carries a CVSS score of 9.3 (Critical).
Timeline: Two Independent Discoveries, Then Real Attacks
- April 10, 2026 — Horizon3.ai reports the flaw to Sangoma as part of a batch of 12 vulnerabilities found in Switchvox.
- May 11, 2026 — Security Risk Advisors (SRA Labs) independently reports the same class of bug, and confirms exploitation can also exfiltrate the appliance's cookie-signing key, enabling session/authentication forgery.
- July 14, 2026 — Sangoma ships the fix in Switchvox SMB Edition 8.4.0.2.
- August 30, 2026 — Horizon3.ai honeypots (deployed with Defused Cyber) detect the first real-world attacks, all originating from a single source IP,
176.65.148.184. - September 2, 2026 — CISA adds CVE-2026-9586 to its Known Exploited Vulnerabilities catalog as part of a seven-CVE batch.
What Exploitation Looks Like
Observed attacks drop reverse shells and enumerate running processes on the compromised PBX, with exfiltrated data base64-encoded and reverse-shell callback traffic seen on port 39323. Defenders can look for entries in /var/log/switchvox/db-quirks.log as an indicator of exploitation attempts against the /pa endpoint.
Shodan scanning puts the internet-exposed footprint at roughly 4,000 instances, most of them in the United States.
Affected Versions and Fix
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Sangoma Switchvox SMB Edition | 8.3 (build 104997) and earlier | 8.4.0.2 |
Sangoma disclosed three related flaws alongside CVE-2026-9586 — CVE-2026-9585, CVE-2026-9587, and CVE-2026-9588, covering XSS, RCE, and local file inclusion respectively — all addressed in the same 8.4.0.2 release.
Why It Matters
Nearly seven weeks passed between the availability of a patch and the first confirmed real-world exploitation — a window in which unpatched, internet-facing PBX systems sat exposed. Business phone systems like Switchvox aggregate call metadata, voicemail, and directory integrations, making a PostgreSQL-superuser-level compromise a foothold for both toll fraud and deeper network intrusion. Organizations running Switchvox should confirm they are on 8.4.0.2 or later immediately, and treat any instance that was internet-facing before the patch as a potential compromise requiring log review.