Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution.

According to security researchers at Horizon3, most of the internet-exposed Switchvox systems have either already been targeted or will be soon.

Switchvox is an enterprise VoIP management platform used to configure and monitor business phone systems.

CVE-2026-9586 is the most serious of 12 flaws Horizon3 discovered and reported to Sangoma on April 10. The vendor fixed them in Switchvox version 8.4.0.2, released on July 14.

The vulnerability is an unauthenticated SQL injection problem in Sangoma Switchvox’s /pa HTTP endpoint. The researchers explain that the endpoint is exposed and parses an XML message containing specific key-value pairs.

Hackers exploit Sangoma Switchvox flaw to deploy reverse shells

Other newsrooms on this story

Related reading

Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without…

Sangoma Switchvox Vulnerability Exploited in the Wild

Critical Vulnerability in HP VoIP Phones Enables Enterprise Network Breaches

Two SonicWall SMA 1000 Zero-Days Exploited, One Could Enable Admin Commands

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

Attackers Exploit Arista VeloCloud Orchestrator Command Injection Flaw