What Changed
BleepingComputer reports that attackers are actively exploiting CVE-2026-9586, the most serious of 12 flaws Horizon3 discovered in Sangoma Switchvox and reported on April 10. Sangoma fixed the issue in version 8.4.0.2 on July 14.
The vulnerable path sits in the /pa HTTP endpoint, which parses XML messages used to notify other phone systems about call events. Horizon3 says the PhoneIP field is concatenated directly into an unparameterized SQL query, allowing a crafted XML request to trigger unauthenticated SQL injection and remote command execution.
Why This Matters Operationally
The real issue is not just that a VoIP management platform has an RCE path. Switchvox is used to configure and monitor business phone systems, which means compromise can land inside a communications system that often has weaker scrutiny than more obvious identity or server infrastructure.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Horizon3's honeypots observed exploitation on August 30 from a single source IP, 176.65.148.184, with the attacker attempting to establish a reverse shell, collect process data from the device, and exfiltrate it in base64-encoded form. That behavior makes this a concrete intrusion-review story, not just a patching reminder.
What Defenders Should Verify First
- Identify every Sangoma Switchvox deployment and confirm whether any internet-exposed instance is still below version 8.4.0.2.
- Inspect
/var/log/switchvox/db-quirks.logfor suspicious SQL-related entries and review network logs for connections to176.65.148.184, especially on port39323. - Treat the issue as a likely mass-targeting problem if the system is internet reachable. Horizon3 says Shodan shows roughly
4,000exposed devices, most in the United States. - Review administrative activity, outbound connections, and any unusual process or shell activity on affected appliances before assuming patching alone closes the story.
Source Context
CyberExperts used BleepingComputer's reporting and the Horizon3 research it cites to preserve the details that change response behavior: the /pa endpoint, the PhoneIP injection path, the fixed version 8.4.0.2, the observed attacker IP and port, and the warning that most exposed Switchvox systems are likely to be or already have been targeted.
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Tuesday’s brief: GitLab’s critical fix, then Patch Tuesday, hijacked fridge controllers and Server 2012’s last update
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
