Active Exploitation of Sangoma Switchvox CVE-2026-9586 Allows Remote Code Execution via Unauthenticated SQL Injection

Active Exploitation of Sangoma Switchvox CVE‑2026‑9586 Enables Remote Code Execution via Unauthenticated SQL Injection

What It Is — An unauthenticated SQL injection (CVE‑2026‑9586) in the /pa HTTP endpoint of Sangoma Switchvox allows attackers to execute arbitrary OS commands and open a reverse shell.

Exploitability — Actively exploited in the wild; Horizon3 observed multiple attempts from a single IP on August 30 2026. No public proof‑of‑concept is required beyond a crafted curl request.

Affected Products — Sangoma Switchvox VoIP management platform (all versions prior to 8.4.0.2).

Why It Matters for Trust & Control Assurance

• Demonstrates the need for a vulnerability‑management control that continuously inventories, patches, and validates critical assets.
• Provides concrete evidence for auditors that you can detect and remediate high‑severity flaws before they are weaponised.
• Highlights the importance of secure configuration and input‑validation controls that map to multiple frameworks (e.g., NIST CSF Identify/Protect, ISO 27001 A.12.6).

Recommended Actions

1. Upgrade every Switchvox instance to version 8.4.0.2 or later immediately.
2. Verify the patch level via automated asset inventory tools.
3. Scan logs (/var/log/switchvox/db-quirks.log) and network traffic for connections to the attacker IP (176.65.148.184) or port 39323.
4. Harden the /pa endpoint: enforce parameterised queries, restrict internet exposure, and apply a web‑application firewall rule for the XML payload.
5. Incorporate the patch‑status check into your continuous control‑monitoring dashboard.

Source: BleepingComputer – Hackers exploit Sangoma Switchvox flaw to deploy reverse shells