Switchvox SMB phones can be hijacked

Published September 2, 2026 CVE-2026-9586

Attackers are breaking into Sangoma Switchvox phone systems without needing a password. Once in, they can read and change the database, plant a reverse shell, and take over the server.

Severity
CriticalCVSS 3.1 · 9.8
Fix
Fixed in 8.4.0.2Fix recorded on Sep 2, 2026
Affected versions
8.3 (104997) to before 8.4.0.2
Weakness
CWE-89SQL Injection
Exploit likelihood
12% in 30 daysEPSS, higher than 96% of known flaws
Affects
Switchvox SMB Edition
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Sep 2, 2026
Federal fix deadline
Sep 5, 2026

How it works

The phone system's /pa endpoint accepts XML messages from IP phones and pastes the phone's IP address straight into a database command without checking it, so a crafted message turns into attacker-controlled database commands.

What to do

Check whether your Switchvox admin console reports version 8.3 build 104997 or earlier, and whether the system is reachable from the open internet. Horizon3.ai says about 4,000 exposed instances exist, mostly in the U.S.

Update to Switchvox 8.4.0.2, released July 14, 2026, which fixes this flaw, and if you were on an earlier version treat admin passwords and the cookie-signing key as potentially exposed and rotate them. Check /var/log/switchvox/db-quirks.log for injection attempts and watch for connections from 176.65.148.184.

Technical details

Affected software: Switchvox SMB Editionby Sangoma

Security researchers at SRA Labs sent a single crafted request to the /pa endpoint, which normally just expects phone check-in messages. The request ran their own commands on the backend database, let them read and edit user accounts, and pulled out the site's cookie-signing key. With that key stolen, they could forge login sessions for any user and also triggered a reverse shell that gave them a remote command line on the server.

CVE-2026-9586 (CVSS 9.3) is an unauthenticated SQL injection in Switchvox SMB Edition 8.3 (104997). The /pa endpoint parses <PolycomIPPhone XML from phone check-ins and concatenates the user-controlled PhoneIP value directly into PostgreSQL queries with no sanitization or parameterization, letting a single crafted request run arbitrary SQL as the PostgreSQL superuser. Horizon3.ai and SRA Labs, who reported it to Sangoma along with 11 other Switchvox bugs in April 2026, showed it can extract and modify database records, escalate to web-admin privileges, exfiltrate the cookie-signing key to forge sessions, and spawn a reverse shell for full remote code execution. In-the-wild exploitation began August 30, 2026 against roughly 4,000 internet-exposed instances.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source