cyber.hendryadrian.com
Vulnerability & Exploit · securityweek.com

Sangoma Switchvox SQL Injection Exploited for Remote Code Execution

· Original article ↗

Summary

Horizon3 and CISA warn that attackers are exploiting CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox that can enable remote code execution. CISA added it to its KEV catalog and urged federal agencies to patch.

Key points

  • CVE-2026-9586 is a critical-severity, unauthenticated SQL injection flaw in Sangoma Switchvox, with a CVSS score of 9.3.
  • The vulnerable endpoint processes XML and fails to sanitize or parameterize the user-controlled PhoneIP value in PostgreSQL queries.
  • A crafted request can run arbitrary SQL statements against the backend database, including operations that enable remote code execution.
  • Horizon3 reported in-the-wild exploitation and shared indicators of compromise to help organizations identify potential intrusions.
  • CISA added the flaw to its Known Exploited Vulnerabilities catalog and urged federal agencies to patch within three days.

Article Details

Vulnerability Types
  • Unauthenticated SQL injection
Severity
Critical (CVSS 9.3)
Exploitation Status
active
Exploit Availability
unknown
Patch Status
unknown

CVE

CVE-2026-9586Tracked as CVE-2026-9586 (CVSS score of 9.3) and described as an unauthenticated SQL injection issue, the security defect can be exploited remotely for arbitrary code execution.

Vendors

SangomaThreat actors have been exploiting a critical-severity vulnerability in the enterprise VoIP telephony management solution Sangoma Switchvox, Horizon3 and CISA warn.

Products

Sangoma SwitchvoxThreat actors have been exploiting a critical-severity vulnerability in the enterprise VoIP telephony management solution Sangoma Switchvox, Horizon3 and CISA warn.

Related Articles