CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can result in remote code execution, is being actively exploited by attackers. The majority of Switchvox systems that are exposed to the internet have either already been targeted or will soon be, according to security researchers at Horizon3.
Business phone systems can be configured and monitored using Switchvox, an enterprise VoIP management platform. The most critical of the 12 vulnerabilities that Horizon3 found and reported to Sangoma on April 10 is CVE-2026-9586. They were resolved by the vendor in Switchvox version 8.4.0.2, which was made available on July 14.
The /pa HTTP endpoint of Sangoma Switchvox has an unauthenticated SQL injection vulnerability. According to the researchers, the endpoint parses an XML message that contains particular key-value pairs.
The PhoneIP field is extracted from the XML message and its value is immediately concatenated into an unparameterized SQL query when /pa receives a request to alert another phone system, such as for an incoming or departing call event.
Through a carefully constructed XML request delivered with the curl command, the researchers showed how this SQL injection may be remotely abused to carry out operating-system operations read more about Hackers exploit Sangoma Switchvox flaw to deploy reverse shells
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.