{"id":"CVE-2026-9586","kind":"vulnerability","aliases":["CVE-2026-9586"],"related":[],"title":"An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997)","description":"Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Unauthenticated SQL injection in the /pa endpoint of on-premises Sangoma Switchvox. The PhoneIP value in the XML body is concatenated into a PostgreSQL query that runs as superuser. COPY ... TO PROGRAM then gives remote code execution. CVSS 4.0 is 9.3. Fixed in 8.4.0.2 (14 Jul 2026). Exploited in the wild since 30 Aug 2026 (reverse shells). Sangoma-managed Switchvox Cloud was already upgraded and is not affected. Upgrading does not clean a host that is already compromised.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2026-09-02T00:00:00+00:00","products":[{"name":"Sangoma Switchvox (on-premises)","fixed":["8.4.0.2"],"affected":"< 8.4.0.2 (CNA record: 8.3 build 104997 up to before 8.4.0.2)","ecosystem":"vendor"},{"name":"sangoma switchvox","fixed":["8.4.0.2"],"affected":">= 8.2.2.1, < 8.4.0.2","ecosystem":"vendor"},{"name":"Sangoma Switchvox","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","pbx","rce","sangoma","self-hosted","sql-injection","switchvox","vendor","voip"],"not_affected_if":["managed-hosting","no-switchvox-deployment","not-internet-exposed","vendor-cloud"],"how_to_check":"Check the version under Server > Maintenance > Updates. Anything below 8.4.0.2 is vulnerable if the Admin or User web portal is reachable from an untrusted network. To look for compromise, SSH in and search /var/log/switchvox/db-quirks.log for COPY (...) TO PROGRAM statements. Look for traffic to or from 176.65.148.184. Check for odd files in /tmp. Sangoma lists these symptoms, but their absence proves nothing: no admin login, high CPU, slow response, failed calls.","fix":"Upgrade to Switchvox 8.4.0.2 (Server > Maintenance > Updates). Before upgrading, restrict web access: Server > Networking > Access Control, disable Web Admin Portal, Web User Portal, Admin API and User API for All Networks, and allow them only from a management network. Re-enable after the upgrade. If compromised: restore a VM snapshot or backup taken before 28 Aug 2026 and then update, or do a clean install of 8.4.0.2 and rebuild the config. Open a Sangoma support case with the subject 'Prem Compromised'. Do not expose Switchvox to the internet; put it behind a VPN or firewall allow-list.","status":"open","published_at":"2026-07-17T17:17:18+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:31:42+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-10-23T20:31:42Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation or patch for Switchvox per CISA BOD 26-04 guidance; the specific fixed version is unknown from the sources.\nIf no mitigation is available, CISA says to discontinue use of the product.","summary":"Sangoma Switchvox, a PBX phone system, has an SQL injection flaw that lets an unauthenticated remote attacker run arbitrary SQL against its PostgreSQL database with one crafted request. The description also says it can lead to remote code execution, and CISA lists it as actively exploited.","category":"vendor","who_cares":["switchvox","sangoma","pbx","self-hosted","voip"],"confidence":0.7,"analyst_note":"Find Sangoma's advisory for CVE-2026-9586 to get affected and fixed versions, the mitigation steps, and any indicators of compromise; the KEV entry gives no version data.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-switchvox-deployment"],"severity_if_unknown":"critical"},"cost_usd":0.000405,"input_tokens":2225,"output_tokens":364,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find Sangoma's advisory for CVE-2026-9586 to get affected and fixed versions, the mitigation steps, and any indicators of compromise; the KEV entry gives no version data.","search":"'-04':174C,200C,231C '-2026':15A,18A '-9586':16A,19A '/pa':47B '104997':13A '14':87B '2026':89B,97B '26':173C,199C,230C '30':95B '4.0':81B '8.3':12A '8.4.0.2':86B '9.3':83B 'accord':163C 'action':159C 'adher':227C 'affect':111B 'allow':130C 'alreadi':106B,120B 'appli':160C 'applic':197C 'arbitrari':137C 'asset':221C 'attack':134C 'aug':96B 'backend':142C 'base':178C 'bod':172C,198C,229C 'bodi':61B 'cisa':157C,170C,187C 'clean':115B 'cloud':104B,203C 'code':78B,155C 'complianc':168C 'compromis':121B 'concaten':63B 'contain':124C 'copi':72B 'craft':148C 'cve':14A,17A 'cvss':80B 'databas':144C,151C 'discontinu':206C 'edit':11A 'endpoint':48B 'ensur':167C,226C 'evalu':219C 'execut':79B,136C,156C 'exist':6A 'exploit':29B,90B 'exposur':224C 'fix':84B 'follow':196C 'forens':189C 'give':76B 'guidanc':185C,201C 'guidelin':233C 'host':35B,117B 'includ':150C 'inject':4A,38B,44B,127C 'instruct':166C 'internet':223C 'jul':88B 'manag':102B 'mitig':161C,212C 'note':184C,195C 'on':23A 'on-premis':50B 'on-premises':22A 'oper':152C 'patch':232C 'pbx':30B 'phoneip':56B 'postgresql':66B,143C 'premis':52B 'premises':24A 'priorit':175C 'product':210C 'program':74B 'queri':67B 'rce':31B 'remot':77B,133C,154C 'request':149C 'requir':158C,191C 'respons':217C 'revers':98B 'risk':180C 'run':69B 'sangoma':8A,20A,25A,27A,32B,53B,101B,122C 'sangoma-manag':100B 'secur':176C 'see':181C,192C 'self':34B 'self-host':33B 'servic':204C 'shell':99B 'sinc':94B 'singl':147C 'smb':10A 'sql':3A,37B,43B,126C,138C 'sql-inject':36B 'stakehold':215C 'statement':139C 'superus':71B 'switchvox':9A,21A,26A,28A,39B,54B,103B,123C 'triag':190C 'unauthent':2A,42B,132C 'unavail':214C 'updat':177C 'upgrad':107B,112B 'url':182C,193C 'use':145C,207C 'valu':57B 'vendor':40B,165C 'voip':41B 'vulner':5A,128C 'wild':93B 'xml':60B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-07-17T17:17:18+00:00","kev":{"dateAdded":"2026-09-02","dueDate":"2026-09-05","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"57dba5dd-1a03-47f6-8b36-e84e47d335d8","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-9586","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586","severity":null,"published_at":"2026-09-02T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T10:39:04+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-9586:90","url":null,"severity":null,"published_at":"2026-10-23T21:30:42+00:00","modified_at":"2026-10-23T21:30:42+00:00","first_seen_at":"2026-10-23T21:30:42+00:00","fetched_at":"2026-10-23T21:30:42+00:00","note":"Primary sources: Sangoma incident statement (9 Sep 2026), 8.4.0.2 release notes, Horizon3 write-up with IOCs, SRA advisory. Fixed version 8.4.0.2 confirmed. Release notes say 8.2.2.1 while the CNA record says 8.3 (104997), so use the '< 8.4.0.2' rule. No public PoC repo found, but Horizon3 shows a curl-style exploit. X has 1 post in 7 days, nothing worth saving."},{"source":"nvd","external_id":"CVE-2026-9586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9586","severity":null,"published_at":"2026-07-17T17:17:18+00:00","modified_at":"2026-09-03T13:06:25+00:00","first_seen_at":"2026-10-23T23:44:52+00:00","fetched_at":"2026-10-23T23:44:52+00:00","note":null}],"documents":[{"id":1047,"url":"https://go.sangoma.com/hubfs/On-Premises%20Sangoma%20Switchvox%20Security%20Incident%20Sept%202026.pdf","title":"Sangoma: On-Premises Switchvox Security Incident","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1048,"url":"https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/","title":"Horizon3: Off the Hook, exploitation of Switchvox CVE-2026-9586","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1049,"url":"https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox%2B-%2BRelease%2BNotes%2BVersion%2B8.4.0.2%2BJuly%2B14%2B2026","title":"Switchvox 8.4.0.2 Release Notes","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1050,"url":"https://labs.sra.io/posts/switchvox/","title":"SRA advisory: Sangoma Switchvox SMB","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}