Back Scworld

Critical SQL injection vulnerability in Sangoma Switchvox exploited in the wild

Scworld • September 2, 2026

The Hacker News reports that threat actors are actively exploiting a critical security vulnerability, identified as CVE-2026-9586, within the Sangoma Switchvox enterprise VoIP platform. This flaw allows unauthenticated remote code execution and poses a significant risk to organizations using the affected software.

The vulnerability, a severe SQL injection flaw with a CVSS score of 9.3, affects Sangoma Switchvox SMB Edition 8.3 (104997). Attackers can exploit it to execute arbitrary code as the PostgreSQL superuser without needing any credentials. The flaw stems from the improper handling of user-controlled input in the /pa endpoint, which directly concatenates phone IP values into database queries without sanitization. Security researchers at Horizon3.ai and Security Risk Advisors (SRA) Labs independently discovered and reported the vulnerability.

Exploitation attempts in the wild have been observed by Horizon3.ai since August 30, 2026, targeting an estimated 4,000 internet-exposed instances, primarily in the U.S. Successful exploitation can lead to database operations, user record modification, privilege escalation, and even remote code execution, enabling attackers to gain full control of the server. Indicators of compromise include specific log entries and an attacker IP address known for malicious activities. Sangoma released patches in version 8.4.0.2 on July 14, 2026, and users are urged to update their systems immediately.

Source: The Hacker News

Steve Zurier September 2, 2026

SC Staff September 1, 2026

Steve Zurier September 1, 2026

Get daily

You can skip this ad in 5 seconds

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Exploitation of Sangoma Switchvox Vulnerabilities Underway Sangoma Switchvox SMB Edition 8.3 is facing active exploitation of multiple vulnerabilities, particularly CVE-2026-9586, which allows unauthenticated SQL injection leading to remote code execution. The flaw can be exploited by sending crafted HTTP POST requests to the /pa endpoint, enabling attackers to execute arbitrary SQL statements against the PostgreSQL database. Approximately 4,000 internet-exposed instances are at risk, primarily in the U.S. The vulnerabilities were discovered by Horizon3 and Security Risk Advisors, with patches released on July 14, 2026. Exploitation attempts began on August 30, 2026, with attackers deploying reverse shells on compromised systems. Organizations are urged to check for signs of compromise and restrict access to vulnerable interfaces. The CVSS score for CVE-2026-9586 is rated at 9.3, indicating a critical severity level. 12 sources 79

Extracted Entities

Critical SQL injection vulnerability in Sangoma Switchvox exploited in the wild

The full story

Extracted Entities

Attack Types (1)

Companies (1)

CVEs (1)

CWE Weaknesses (1)

Domains (1)

Platforms (2)