Sangoma Switchvox CVE-2026-9586, an unauthenticated SQL injection flaw capable of leading to remote code execution, is being actively exploited in the wild, with Horizon3 warning that most internet-exposed Switchvox systems have already been targeted or will be shortly. CISA moved quickly: it added the vulnerability to its Known Exploited Vulnerabilities catalogue on 2 September 2026 and set a 5 September remediation deadline for federal civilian agencies under Binding Operational Directive 26-04, according to Cyber One Solutions.
What makes CVE-2026-9586 so easy to exploit
Switchvox is a VoIP-based unified communications platform built on the open-source Asterisk engine and aimed at small and medium-size businesses, as Help Net Security notes. That SMB focus matters: smaller IT teams are less likely to have the monitoring capacity to catch an intrusion quickly, and VoIP infrastructure sits at the heart of day-to-day operations.
The flaw lives in the platform’s /pa HTTP endpoint, which is exposed and parses an XML message containing specific key-value pairs. When /pa receives a request to notify another phone system of an incoming or outgoing call event, it extracts the PhoneIP field from the XML message and concatenates its value directly into an unparameterised SQL query. No authentication is required. A crafted XML request sent via curl is enough to get operating-system commands executing on the remote host, a low bar that explains the speed of exploitation once the flaw became public knowledge.
CVE-2026-9586 is the most serious of 12 flaws Horizon3 discovered and reported to Sangoma on 10 April. The vendor’s response was prompt: Sangoma acknowledged the report the same day and provided a pre-release build containing validation fixes on 21 April, according to eSecurityPlanet. The public patch, Switchvox version 8.4.0.2, followed on 14 July.
Sangoma Switchvox CVE-2026-9586 caught in active exploitation
On 30 August, Horizon3’s honeypots observed active exploitation across multiple systems in rapid succession, all originating from a single source IP address: 176.65.148.184. The attacker attempted to establish a reverse shell, executing an initial payload before collecting information about the top processes running on each Switchvox system. That reconnaissance data was then exfiltrated to a remote server in base64-encoded form.
‘Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet-exposed Switchvox instances will be or have already been targeted,’ Horizon3 warned. The firm added that Shodan shows approximately 4,000 Switchvox devices currently exposed on the internet, with most located within the United States.
It is worth noting that the vulnerability was discovered independently by Security Risk Advisors as well as by Horizon3, both working from the April disclosure window. Horizon3 says it has not observed active exploitation of the remaining 11 flaws it reported to Sangoma.
What administrators should do right now
The remediation path is straightforward: upgrade to Switchvox version 8.4.0.2 or later as soon as possible. For organisations already running an exposed instance, patching alone is not enough, administrators should also check for signs of compromise. Horizon3 flags two concrete indicators: suspicious entries in /var/log/switchvox/db-quirks.log and network connections to the attacker IP (176.65.148.184), particularly on port 39323.
The CISA deadline of 5 September applies specifically to federal civilian agencies, but the catalogue listing is a reliable signal for everyone else: when CISA considers a vulnerability urgent enough for a binding directive, private-sector operators of the same software should treat it with equal urgency. Horizon3 has published its technical analysis, giving defenders the detail they need to confirm whether an attack has already landed, and giving any remaining unpatched operators a clear picture of what an attacker can do with a single crafted HTTP request.
