Executive Summary
Sangoma Switchvox, an enterprise VoIP telephony management solution, is facing active exploitation of a critical unauthenticated SQL injection vulnerability tracked as CVE-2026-9586. Initially discovered by Horizon3 researchers in April 2026, the flaw was patched in July 2026; however, active in-the-wild exploitation was observed starting August 30, 2026.
The attack vector targets the `/pa` HTTP endpoint, where an attacker can supply a malicious XML message containing a crafted `PhoneIP` field. Because this field is concatenated directly into a PostgreSQL query executed as a superuser, attackers can leverage the `COPY ... TO PROGRAM` command to execute arbitrary system commands.
With approximately 4,000 Switchvox devices currently exposed to the internet, primarily in the United States, there is high urgency to patch. Exploitation attempts have been observed in rapid succession from the same source IP, suggesting automated scanning and targeting of vulnerable instances. Organizations should immediately update to version 8.4.0.2 or later.