ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
Organization

Security Risk Advisors

0 mentions in 7 days · 1 in 30 days · 1 total · first seen · last

Search everything

Timeline

CVE-2026-9586 | Sangoma Switchvox Unauthenticated SQL Injection Remote Code Execution Vulnerability

CVE-2026-9586, a critical unauthenticated SQL injection to RCE in Sangoma Switchvox, is being actively exploited against internet-facing systems per honeypot observations.

CVE-2026-9586 (CVSS 4.0: 9.3) is an unauthenticated SQL injection in the /pa endpoint of Sangoma Switchvox SMB Edition, where the unsanitized PhoneIP value in XML phone notification requests reaches the PostgreSQL database. Horizon3 demonstrated escalation to OS command execution, and honeypots run with Defused Cyber observed exploitation attempts on August 30, 2026, using PostgreSQL commands with nc and curl. Fixed in Switchvox 8.4.0.2 released July 14, 2026; one attacker IP (176.65.148.184) was documented.

Horizon3.ai · 14d agoExploit / PoC in the wildCVE-2026-9586

Related CVEs

  • CVE-2026-95869.312%
    Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
    Sangoma Switchvox SMB Edition 8.3 (build 104997) contains an unauthenticated SQL injection flaw (CWE-89) in its /pa endpoint, where the user-controlled PhoneIP value from XML input is concatenated directly into PostgreSQL queries without sanitization or parameterization. A single crafted request lets a remote, unauthenticated attacker execute arbitrary SQL statements against the backend PostgreSQL database, which can be escalated to remote code execution on the server. Any organization running the affected Switchvox SMB Edition build is exposed, especially appliances reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-09-02, and researchers have observed attackers using it without credentials to deploy reverse shells and cryptocurrency miners.
    · Sangoma Switchvox SMB Edition 8.3 (build 104997) KEV PoC moderate

Appears with

organization Defused Cyber 1organization Horizon3 1organization Sangoma 1product PostgreSQL 1product Switchvox 1vendor Defused Cyber 1vendor Horizon3 1vendor Sangoma 1
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.