A threat actor is actively targeting internet-exposed Sangoma Switchvox instance through a recently patched SQL injection flaw (CVE-2026-9586), and organizations running them should check for signs of compromise immediately.
How CVE-2026-9586 works
Switchvox is a VoIP-based unified communications platform built on the open-source Asterisk engine and aimed at small and medium-size businesses. It can be deployed on-premises, in the cloud, or on virtualized infrastructure.
CVE-2026-9586, found in Sangoma Switchvox SMB Edition 8.3, allows attackers to send a specially crafted HTTP POST request to an endpoint that doesn’t require authentication, and thus execute arbitrary SQL statements against the backend PostgreSQL database.
The vulnerability was discovered in April 2026 by Horizon3 researchers and (independently, a bit later) by Security Risk Advisors. Both reported it and other unearthed flaws to Sangoma, and CVE-2026-9586 was patched in Switchvox version 8.4.0.2, released on July 14, 2026.
Horizon3 deployed internet honeypots mimicking systems running Switchvox in coordination with threat intelligency company Defused Cyber in May 2026 – before Sangoma shipped fixes – to monitor for exploitation of the discovered vulnerabilities.
On August 30, the honeypots started seeing exploitation attempts against CVE-2026-9586.
What the attacker is doing
The attempts came from a single IP address. The attacker drops reverse shells on compromised systems and then runs commands to enumerate running processes.
The indicators of compromise outlined by Horizon3 researcher Zach Hanley include specific log entries and the attackers’ IP address (176.65.148.184).
“Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet exposed Switchvox instances will be or have already been targeted,” he warned.
“Currently Shodan shows that there are approximately 4,000 devices on the internet, with most located within the United States.”
Switchvox users who can’t update their instance to a fixed version should restrict network access to the Switchvox interfaces and the /pa endpoint.