Critical Sangoma Switchvox RCE Under Active Exploit: 4,000 Internet-Exposed PBX Systems at Risk

As reported by The Hacker News, threat actors are actively exploiting CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox, to deploy reverse shells on compromised systems. This is not a theoretical risk — exploitation began August 30, 2026, and the window between patch availability and in-the-wild exploitation was barely six weeks.

Vulnerability Summary

Why This Matters Beyond the Headline

What makes CVE-2026-9586 particularly dangerous is the attack chain's simplicity. The /pa endpoint accepts XML content and directly concatenates user-controlled input into PostgreSQL queries — a textbook injection flaw that an unauthenticated attacker can weaponize in a single request. The attacker doesn't need credentials, doesn't need user interaction, and can pivot from SQL injection to full code execution because PostgreSQL superuser privileges are in play.

SRA Labs demonstrated that exploitation enables exfiltration of the cookie signing key, allowing attackers to forge authentication material for arbitrary users. This means even organizations that patched late may have already had their session infrastructure compromised — a patch does not invalidate stolen signing keys or rotate forged session tokens.

The real danger isn't just the reverse shell — it's the persistent access an attacker can establish by forging authentication cookies before you even realize the system was compromised.

The fact that Horizon3.ai reported 12 distinct vulnerabilities in Switchvox to Sangoma in April 2026 suggests this is a platform with systemic code quality issues around input handling. Defenders should assume additional CVEs may surface and plan accordingly.

Who Is Most at Risk

Indicators of Compromise

• SQL injection payloads visible in /var/log/switchvox/db-quirks.log (on SSH-enabled devices)
• Attacker IP: 176.65.148[.]184 (flagged on VirusTotal for port scanning, brute-force, and exploitation activity)
• Base64-encoded command execution following reverse shell deployment
• Anomalous outbound connections from the Switchvox appliance

Shield53 Recommendations

Immediate Actions

• Patch NOW: Upgrade to Switchvox 8.4.0.2 or later. This is non-negotiable for any internet-facing instance.
• Isolate the appliance: If patching cannot be completed immediately, restrict access to the Switchvox management interface via VPN, firewall allowlisting, or reverse proxy with authentication. The /pa endpoint should never be internet-reachable.
• Hunt for compromise: Do not assume a patch means you're clean. Check /var/log/switchvox/db-quirks.log for SQL injection payloads, review outbound connection logs, and look for reverse shell activity or unexpected processes.
• Rotate credentials and keys: If any evidence of prior exploitation exists, rotate the cookie signing key, all administrative passwords, and any credentials stored in or accessible through the Switchvox database. Forged session tokens may persist beyond patching.
• Block known IOCs: Add 176.65.148.184 to network blocklists and monitor for historical connections to this IP.

Strategic Actions

• Segment VoIP infrastructure: PBX systems should not share network space with general corporate infrastructure. Treat VoIP appliances as critical infrastructure requiring dedicated network zones.
• Audit all Sangoma products: Given the 12-vulnerability disclosure, audit your entire Sangoma footprint — not just Switchvox — for exposure and patch currency.
• Implement database monitoring: PostgreSQL query logging or a database activity monitor would have caught this injection early. Ensure your detection capabilities cover appliance-embedded databases, not just enterprise databases.