Switchvox SQLi exploited in the wild (CVE-2026-9586) [PoC]

Actively exploited in the wild - CVE-2026-9586 is a critical unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (104997) that grants remote attackers full database control and potential code execution. No vendor patch has been confirmed; isolate affected systems immediately.

Overview

CVE-2026-9586 is a pre-authentication SQL injection vulnerability in the /pa endpoint of Sangoma Switchvox SMB Edition 8.3 (build 104997). The endpoint processes XML content beginning with <PolycomIPPhone> and concatenates the user-supplied PhoneIP value directly into PostgreSQL queries without sanitization or parameterization.

A single crafted HTTP request lets an unauthenticated remote attacker execute arbitrary SQL statements against the backend database. This can lead to data exfiltration, credential theft, database destruction, or - when combined with PostgreSQL functions - remote code execution on the underlying operating system.

The vulnerability carries a CVSS score of 9.3 (Critical) with a vector of AV:N/AC:L/PR:N/UI:N, reflecting network exploitability with no authentication or user interaction required. CISA has added this CVE to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation. The EPSS model estimates a 1.1% probability of exploitation in the next 30 days, though real-world attacks are already underway.

Affected Systems

• Sangoma Switchvox SMB Edition version 8.3 (build 104997)
• Any Switchvox deployment with the /pa endpoint reachable from untrusted networks

Remediation

• Check for vendor updates or patches from Sangoma immediately. If a patched build is available, upgrade before reconnecting the system to production networks.
• If no patch exists, restrict access to the /pa endpoint and the Switchvox management interface using firewall rules or access control lists. Allow connections only from trusted IP ranges.
• Monitor PostgreSQL logs and Switchvox access logs for unusual queries or repeated requests containing <PolycomIPPhone>.
• Audit backend database contents for signs of tampering or data exfiltration, especially user credentials and call records.
• Assume compromise if the system was internet-exposed; perform forensic review and rotate all credentials stored in or reachable from the database.

Security Insight

This vulnerability exposes a recurring pattern in unified communications appliances: legacy XML-handling endpoints rarely receive the same security scrutiny as modern APIs. The fact that an unauthenticated attacker can reach a PostgreSQL backend through a phone-provisioning endpoint suggests the trust boundary between device-facing services and core infrastructure collapsed. Sangoma’s delayed patch response for an actively exploited critical issue, despite CISA KEV listing, indicates that affected organizations cannot rely on vendor timelines and must treat internet-exposed UC systems as high-value, high-risk assets requiring aggressive network segmentation.

Further Reading

• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs