Hackers Attack the Sangoma Switchvox VoIP Platform Through SQL Injection

Security researchers at Horizon3 have reported active exploitation of the CVE-2026-9586 vulnerability in Sangoma Switchvox, an enterprise telephony management platform. The flaw is an SQL injection that can be carried out without authentication and leads to remote execution of operating-system commands.

Switchvox is a system for configuring and monitoring VoIP-based business telephony. The vulnerability that was found turned out to be the most serious of the twelve that Horizon3 reported to the vendor back on April 10. Sangoma fixed them in Switchvox version 8.4.0.2, released on July 14.

How the Attack Works

The problem lies in the /pa HTTP endpoint, which parses XML messages containing certain key–value pairs. When /pa receives a notification request from another phone system — for example, about an incoming or outgoing call — it extracts the PhoneIP field from the XML and inserts its value directly into a non-parameterized SQL query. It is precisely this direct concatenation that opens the door to injection.

The researchers demonstrated that a specially crafted XML request, sent with an ordinary curl command, makes it possible to remotely execute commands at the OS level.

The Attacks Are Already Underway

On August 30, Horizon3's honeypots recorded active exploitation: from a single IP address (176.65.148.184), several systems were attacked in rapid succession, and the attacker attempted to set up a reverse shell. It ran an initial payload, gathered data on the most resource-intensive processes on the device, and sent them to a remote server encoded in base64.

In the specialists' assessment, the speed and scope of the attacks indicate that most internet-facing Switchvox instances have either already been attacked or will be in the near future. According to Shodan, there are around 4,000 such devices online, most of them in the United States.

The researchers have not yet observed any signs of exploitation of the remaining eleven vulnerabilities.

What Administrators Should Do

Horizon3 strongly recommends updating to Switchvox version 8.4.0.2 or newer as soon as possible and checking systems for signs of compromise. Indirect indicators of a breach include suspicious entries in the /var/log/switchvox/db-quirks.log log and network connections to the attacker's IP address noted above, especially over port 39323.

Source: Bleeping Computer