Attackers are actively exploiting a critical vulnerability in Sangoma Switchvox, a widely deployed enterprise VoIP management platform used to run and monitor business phone systems. The flaw, tracked as CVE-2026-9586, is an unauthenticated SQL injection bug in the platform’s /pa HTTP endpoint — meaning attackers can reach it without any login credentials.
The endpoint parses XML messages containing phone-event data. When it receives a notification about a call event, it pulls a PhoneIP field from the XML and plugs it directly into a SQL query without any input sanitization. Security researchers at Horizon3, who discovered and reported the issue to Sangoma in April, demonstrated that a crafted XML request sent via curl is enough to run arbitrary operating-system commands on the underlying server. Their honeypots observed active exploitation across multiple systems on August 30. Most internet-exposed Switchvox instances have either already been targeted or are expected to be targeted soon.
How to check if you’re affected
Affected versions are all Switchvox releases before version 8.4.0.2. Sangoma released the fix on July 14, 2026. If your Switchvox admin console shows a version lower than 8.4.0.2, your system is exposed and should be updated immediately.
If you manage a Switchvox deployment, also review server logs for unexpected outbound connections or new processes spawned by the web server — signs of a reverse shell being established.