CVE-2026-9586: Unauthenticated SQL Injection in Sangoma Switchvox Actively Exploited; One Request Yields a Root Reverse Shell
Sangoma Switchvox SMB has an unauthenticated SQL injection, CVE-2026-9586 (CVSS 9.3). Honeypots caught live attacks. Attackers abuse PostgreSQL COPY TO PROGRAM for root-level remote code execution.
CVE-2026-9586 is in the wild. Horizon3 disclosed on September 1 that an unauthenticated SQL injection in Sangoma Switchvox SMB (CVSS 4.0 score 9.3) is being exploited. Multiple honeypots captured working attempts from the same source IP. Roughly 4,000 Switchvox devices on the public internet are at immediate risk.
Incident Overview
Switchvox is Sangoma's IP PBX. The SMB edition is widely deployed in small and mid-size businesses. Horizon3 found the bug independently while auditing the Sangoma ecosystem. Honeypots jointly deployed with Defused Cyber recorded a live attack on August 30: the attacker's first step bounced a shell from the victim to 176.65.148.184, then immediately ran recon to steal the process list.
Technical Details
Root cause is the /pa HTTP endpoint that handles phone notification requests. When it receives an XML message starting with a specific marker, PhoneAppsHandler.pm concatenates the PhoneIP field into a PostgreSQL query string with no parameterization. The DB connection runs as PostgreSQL superuser, so the attacker can use COPY TO PROGRAM to turn injected SQL into OS command execution. One crafted HTTP request yields a full reverse shell.
Exploitation traces show up in /var/log/switchvox/db-quirks.log, which records SQL the engine considers anomalous. Horizon3 published a sample payload containing COPY TO PROGRAM.
Impact Assessment
No auth, no interaction, low complexity, plus circulating PoC and honeypot-confirmed exploitation. Public Switchvox instances (Shodan ~4,000, mostly in the US) will be hit. A compromised PBX means call interception and an internal pivot. Sangoma received the report on April 10. Official fix 8.4.0.2 shipped July 14. Many devices remain unpatched.
Remediation
- Upgrade Switchvox SMB to 8.4.0.2 or later
- Check
db-quirks.logand network logs for source IP 176.65.148.184 or COPY TO PROGRAM payload signatures - Restrict management interfaces to the internal network; do not expose PBX ports to the internet
- If you cannot upgrade yet, block external access to the
/paendpoint at the firewall
Sources
- CVETodo: Switchvox in-the-wild exploitation analysis (2026-09-01)
- Horizon3 official disclosure