Sangoma Switchvox SQLi exploited for reverse shells

What Happened

Threat actors are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform, to deploy reverse shells on compromised systems. According to field reports, the flaw enables remote code execution, and observed campaigns are targeting internet-exposed Switchvox instances. The exploitation activity appears automated in nature, with attackers moving quickly from initial injection to establishing persistent command-and-control access.

Why It Matters

Switchvox is a widely deployed IP-PBX system used by small and medium businesses, call centers, and managed service providers. Because VoIP systems sit at the edge of the network and handle sensitive call metadata, voicemail, and sometimes call recordings, a full compromise gives attackers a foothold inside the corporate telephony layer. This is not merely a server compromise: attackers with reverse shell access to a PBX can pivot into internal networks, intercept communications, and use the device as a relay for further attacks. For organizations that have not segmented their VoIP infrastructure, the blast radius expands significantly.

Technical Details

The vulnerability, tracked as CVE-2026-9586, resides in an unauthenticated endpoint within the Switchvox web interface. The SQL injection allows an attacker to bypass authentication and execute arbitrary SQL queries. In the observed exploitation chain, attackers leverage stacked queries to write files or invoke system commands, resulting in a reverse shell callback to an external host. No authentication is required to trigger the flaw, and no user interaction is necessary.

Indicators of compromise include:

• Unexpected outbound connections from the Switchvox server to non-standard ports (common reverse shell ports such as 4444, 8080, or high random ports).
• Abnormal SQL error messages or slow database responses in Switchvox logs.
• Presence of suspicious files in web-accessible directories, often PHP or JSP shells.
• New cron jobs or scheduled tasks pointing to external URLs.

Organizations using Switchvox should immediately review firewall logs for outbound connections from their PBX to unknown IPs, and inspect the web server logs for SQL injection patterns targeting the vulnerable parameter.

Immediate Risk

The severity is critical for any Sangoma Switchvox instance exposed to the internet. Proof-of-concept exploitation has been confirmed in the wild, and the lack of authentication requirements means that even low-skill attackers can leverage publicly available tooling to compromise systems. The risk is elevated for organizations that have delayed patching or that rely on default configurations. Given the active exploitation, the window for proactive defense is closing rapidly. Sangoma has released a patch; organizations should treat this as an emergency change and apply it outside normal maintenance windows if exposure is confirmed.

Security Insight

A common defensive oversight is treating VoIP systems as isolated appliances rather than as general-purpose servers. The Switchvox exploitation highlights a recurring pattern: PBX platforms often run with outdated operating systems, lack host-based intrusion detection, and are administered through the same credentials as the rest of the network. A practical takeaway is to enforce strict egress filtering for all telephony servers. If a PBX does not need to initiate outbound connections to arbitrary internet hosts, block them at the firewall. This simple control would have neutralized the reverse shell stage of this attack even if the initial injection succeeded. Organizations should also apply the principle of least privilege to call recording and voicemail storage, as these data stores are high-value targets for attackers seeking credential material or sensitive business conversations.

Further Reading

• Switchvox SQLi exploited in the wild (CVE-2026-9586) [PoC]
• Latest Security News
• CVE Advisories
• Data Breach Reports