Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)
Attackers actively exploit SQL injection flaw CVE-2026-9586 in unauthenticated Sangoma Switchvox endpoints, dropping reverse shells and second-stage cryptominer malware.
CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3, lets crafted HTTP POST requests execute arbitrary SQL against the backend PostgreSQL database. Horizon3 honeypots first saw exploitation on August 30, 2026 from IP 176.65.148.184, and dozens of additional source IPs have since joined with scanning payloads and second-stage malware that appears to be a cryptominer. The flaw was patched in Switchvox 8.4.0.2 on July 14, 2026; roughly 4,000 exposed instances exist, mostly in the United States, and exploitation is likely against most of them.
- Unauthenticated HTTP POST to the /pa endpoint enables arbitrary SQL execution.
- Attacker deploys reverse shells and enumerates running processes on compromised hosts.
- Second-stage malware observed appears to be a cryptominer; more source IPs now exploiting.
- Appliance may serve as pivot point using stored integration credentials.
- Restrict network access to Switchvox interfaces if patching to 8.4.0.2 is not possible.
- CVEs
- CVE-2026-9586
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1059.004 Unix ShellT1057 Process DiscoveryT1105 Ingress Tool TransferT1496 Resource Hijacking
- Malware
- cryptominer
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-9586 | Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition | 9.3 | 19% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 176.65.148.184 | include specific log entries and the attackers’ IP address (176.65.148.184). “Given the quick succession of exploit attempts across mu |
From the original article
2 min read at helpnetsecurity.com
A threat actor is actively targeting internet-exposed Sangoma Switchvox instance through a recently patched SQL injection flaw (CVE-2026-9586), and organizations running them should check for signs of compromise immediately. Switchvox is a VoIP-based unified communications platform built on the open-source Asterisk engine and aimed at small and medium-size businesses.
By @zeljkazorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.