Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)
Attackers actively exploit SQL injection flaw CVE-2026-9586 in unauthenticated Sangoma Switchvox endpoints, dropping reverse shells and second-stage cryptominer malware.
58
Vendor
Defused Cyber
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenAug 12, 2026
- Last mentionedSep 2, 2026
Timeline
3 articles · newest firstCVE-2026-9586 | Sangoma Switchvox Unauthenticated SQL Injection Remote Code Execution Vulnerability
CVE-2026-9586, a critical unauthenticated SQL injection to RCE in Sangoma Switchvox, is being actively exploited against internet-facing systems per honeypot observations.
64
Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access
Attackers actively exploit critical VMware vCenter flaw CVE-2026-59310, installing reverse_ssh backdoors on 361 hosts across 47 countries.
88
Related CVEs
by mentions- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
- CVE-2026-593103%9.8Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
- CVE-2026-593098%9.8VMware vCenter contains an authentication bypass vulnerability in the VMware Directory Service
Appears with
- Horizon3vendor · 2
- Switchvoxproduct · 2
- Sangomavendor · 2
- Sangomaorganization · 2
- Horizon3organization · 2
- VMware vCenterproduct · 1
- Broadcomvendor · 1
- The Hacker Newsorganization · 1
- Defused Cyberorganization · 1
- QUIRSOvendor · 1
- SentinelOnevendor · 1
- UNC5174threat actor · 1
- Asteriskproduct · 1
- GoReShellmalware · 1
- Security Risk Advisorsorganization · 1
- VMware Toolsproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.