Critical SQL injection vulnerability in Sangoma Switchvox exploited in the wild

The Hacker News reports that threat actors are actively exploiting a critical security vulnerability, identified as CVE-2026-9586, within the Sangoma Switchvox enterprise VoIP platform. This flaw allows unauthenticated remote code execution and poses a significant risk to organizations using the affected software.

The vulnerability, a severe SQL injection flaw with a CVSS score of 9.3, affects Sangoma Switchvox SMB Edition 8.3 (104997). Attackers can exploit it to execute arbitrary code as the PostgreSQL superuser without needing any credentials. The flaw stems from the improper handling of user-controlled input in the /pa endpoint, which directly concatenates phone IP values into database queries without sanitization. Security researchers at Horizon3.ai and Security Risk Advisors (SRA) Labs independently discovered and reported the vulnerability.

Exploitation attempts in the wild have been observed by Horizon3.ai since August 30, 2026, targeting an estimated 4,000 internet-exposed instances, primarily in the U.S. Successful exploitation can lead to database operations, user record modification, privilege escalation, and even remote code execution, enabling attackers to gain full control of the server. Indicators of compromise include specific log entries and an attacker IP address known for malicious activities. Sangoma released patches in version 8.4.0.2 on July 14, 2026, and users are urged to update their systems immediately.

Source: The Hacker News