--- id: "CVE-2026-9586" kind: "vulnerability" aliases: ["CVE-2026-9586"] title: "An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997)" severity: "critical" cvss: 9.8 epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Sangoma Switchvox (on-premises)", "fixed": ["8.4.0.2"], "affected": "< 8.4.0.2 (CNA record: 8.3 build 104997 up to before 8.4.0.2)", "ecosystem": "vendor"}, {"name": "sangoma switchvox", "fixed": ["8.4.0.2"], "affected": ">= 8.2.2.1, < 8.4.0.2", "ecosystem": "vendor"}, {"name": "Sangoma Switchvox", "fixed": [], "affected": "", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "pbx", "rce", "sangoma", "self-hosted", "sql-injection", "switchvox", "vendor", "voip"] not_affected_if: ["managed-hosting", "no-switchvox-deployment", "not-internet-exposed", "vendor-cloud"] published_at: "2026-07-17T17:17:18+00:00" first_seen_at: "2026-10-23T19:11:51+00:00" updated_at: "2026-10-24T00:09:50+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:30:42+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-9586", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) Unauthenticated SQL injection in the /pa endpoint of on-premises Sangoma Switchvox. The PhoneIP value in the XML body is concatenated into a PostgreSQL query that runs as superuser. COPY ... TO PROGRAM then gives remote code execution. CVSS 4.0 is 9.3. Fixed in 8.4.0.2 (14 Jul 2026). Exploited in the wild since 30 Aug 2026 (reverse shells). Sangoma-managed Switchvox Cloud was already upgraded and is not affected. Upgrading does not clean a host that is already compromised. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Sangoma Switchvox (on-premises) affected < 8.4.0.2 (CNA record: 8.3 build 104997 up to before 8.4.0.2) fixed 8.4.0.2 - vendor:sangoma switchvox affected >= 8.2.2.1, < 8.4.0.2 fixed 8.4.0.2 - vendor:Sangoma Switchvox affected ? fixed ? ## How to check Check the version under Server > Maintenance > Updates. Anything below 8.4.0.2 is vulnerable if the Admin or User web portal is reachable from an untrusted network. To look for compromise, SSH in and search /var/log/switchvox/db-quirks.log for COPY (...) TO PROGRAM statements. Look for traffic to or from 176.65.148.184. Check for odd files in /tmp. Sangoma lists these symptoms, but their absence proves nothing: no admin login, high CPU, slow response, failed calls. ## Fix Upgrade to Switchvox 8.4.0.2 (Server > Maintenance > Updates). Before upgrading, restrict web access: Server > Networking > Access Control, disable Web Admin Portal, Web User Portal, Admin API and User API for All Networks, and allow them only from a management network. Re-enable after the upgrade. If compromised: restore a VM snapshot or backup taken before 28 Aug 2026 and then update, or do a clean install of 8.4.0.2 and rebuild the config. Open a Sangoma support case with the subject 'Prem Compromised'. Do not expose Switchvox to the internet; put it behind a VPN or firewall allow-list. ## Timeline - 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-9586 - 2026-10-23T21:30:42+00:00 analyst — Primary sources: Sangoma incident statement (9 Sep 2026), 8.4.0.2 release notes, Horizon3 write-up with IOCs, SRA advisory. Fixed version 8.4.0.2 confirmed. Release notes say 8.2.2.1 while the CNA record says 8.3 (104997), so use the '< 8.4.0.2' rule. No public PoC repo found, but Horizon3 shows a curl-style exploit. X has 1 post in 7 days, nothing worth saving. - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-9586 ## Documents - [advisory] Sangoma: On-Premises Switchvox Security Incident https://go.sangoma.com/hubfs/On-Premises%20Sangoma%20Switchvox%20Security%20Incident%20Sept%202026.pdf - [advisory] SRA advisory: Sangoma Switchvox SMB https://labs.sra.io/posts/switchvox/ - [describes] Horizon3: Off the Hook, exploitation of Switchvox CVE-2026-9586 https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/ - [fix] Switchvox 8.4.0.2 Release Notes https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox%2B-%2BRelease%2BNotes%2BVersion%2B8.4.0.2%2BJuly%2B14%2B2026 ## From the sources Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_