Attackers Exploit Sangoma Switchvox SQL Injection Flaw CVE-2026-9586
Summary
Attackers are exploiting CVE-2026-9586, an unauthenticated SQL injection flaw in Switchvox SMB Edition 8.3, to deploy reverse shells and additional malware. Version 8.4.0.2 fixes the flaw; users should update or restrict access.
Key points
- CVE-2026-9586 allows unauthenticated SQL injection through a crafted HTTP POST request against Sangoma Switchvox SMB Edition 8.3.
- Sangoma patched the flaw in Switchvox 8.4.0.2, released July 14, 2026.
- Horizon3 honeypots first observed exploitation attempts on August 30, initially from one IP address; later observations included dozens of additional source IPs.
- The attacker dropped reverse shells, enumerated processes, and later downloaded second-stage malware that appeared, on cursory inspection, to be a cryptominer.
- Horizon3 recommends checking for compromise and, if unable to update, restricting access to Switchvox interfaces and the /pa endpoint.
- Horizon3 warned that Switchvox appliances could potentially be used as pivots into internal networks; the article does not report confirmed victim impact.
Article Details
- Vulnerability Types
- SQL injection
- Affected Versions
- Sangoma Switchvox SMB Edition 8.3
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Restrict network access to the Switchvox interfaces and the /pa endpoint if unable to update.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 176[.]65[.]148[.]184 | Source IP address for exploitation attempts against the honeypots. |
MITRE ATT&CK
T1057 · Process DiscoveryAfter dropping reverse shells, the attacker ran commands to enumerate running processes.T1105 · Ingress Tool TransferThe attacker was observed downloading second-stage malware onto compromised systems.T1190 · Exploit Public-Facing ApplicationThe attacker exploited an unauthenticated SQL injection flaw in internet-exposed Switchvox instances.
CVE
People
Vendors
Products
AsteriskSwitchvox is a VoIP-based unified communications platform built on the open-source Asterisk engine and aimed at small and medium-size businesses.Sangoma SwitchvoxA threat actor is actively exploiting the recently patched CVE-2026-9586 SQL injection flaw in internet-exposed Sangoma Switchvox instances, dropping reverse shells and later staging additional malware.