A threat actor is actively targeting internet-exposed Sangoma Switchvox instance through a recently patched SQL injection flaw (CVE-2026-9586), and organizations running them should check for signs of compromise immediately.
How CVE-2026-9586 works
Switchvox is a VoIP-based unified communications platform built on the open-source Asterisk engine and aimed at small and medium-size businesses. It can be deployed on-premises, in the cloud, or on virtualized infrastructure.
CVE-2026-9586, found in Sangoma Switchvox SMB Edition 8.3, allows attackers to send a specially crafted HTTP POST request to an endpoint that doesn’t require authentication, and thus execute arbitrary SQL statements against the backend PostgreSQL database.
The vulnerability was discovered in April 2026 by Horizon3 researchers and (independently, a bit later) by Security Risk Advisors. Both reported it and other unearthed flaws to Sangoma, and CVE-2026-9586 was patched in Switchvox version 8.4.0.2, released on July 14, 2026.
Horizon3 deployed internet honeypots mimicking systems running Switchvox in coordination with threat intelligency company Defused Cyber in May 2026 – before Sangoma shipped fixes – to monitor for exploitation of the discovered vulnerabilities.
On August 30, the honeypots started seeing exploitation attempts against CVE-2026-9586.
What the attacker is doing
The attempts came from a single IP address. The attacker drops reverse shells on compromised systems and then runs commands to enumerate running processes.
The indicators of compromise outlined by Horizon3 researcher Zach Hanley include specific log entries and the attackers’ IP address (176.65.148.184).
“Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet exposed Switchvox instances will be or have already been targeted,” he warned.
“Currently Shodan shows that there are approximately 4,000 devices on the internet, with most located within the United States.”
Switchvox users who can’t update their instance to a fixed version should restrict network access to the Switchvox interfaces and the /pa endpoint.
UPDATE (September 2, 2026, 02:45 p.m. ET):
“The Switchvox appliance is likely most valuable as a pivot point into organizations from external into internal networks. It is possible some appliances hold integration secrets that may allow them to pivot with stolen credentials,” Zach Hanley told Help Net Security via email.
But the threat actor is currently after something else: since the initial observations, the same threat actor has been observed downloading second-stage malware onto the system, which on a cursory look appeared to be a cryptominer, he shared.
Also, since his post was published, dozens of additional source IPs have been observed exploiting the honeypots to include simple scanning payloads and also more second stage malware installation.
Hanley said that Horizon3 plans to continue the collaboration with Defused Cyber: “With the increased capabilities of LLMs in the vulnerability discovery space, we believe that duplicate findings will be the norm and having insight into when they become known and exploited is valuable.”
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Leave A Comment