Sangoma Switchvox

CVE-2026-9586, Sangoma Switchvox: an unauthenticated XML phone-notification endpoint reaches PostgreSQL COPY TO PROGRAM, and honeypots caught exploitation nearly seven weeks after the patch shipped

Sangoma Switchvox is a VoIP/unified-communications platform built on Asterisk. It exposes an unauthenticated HTTP endpoint, /pa, handled by PhoneAppsHandler.pm, meant to let supported desk phones receive call-event notifications. The handler validates only that the POST body starts with the literal string <PolycomIPPhone>, no further sanitisation, before parsing it as XML via XML::Simple::XMLin() and extracting the PhoneIP field with no validation, concatenating it directly into an unparameterized SQL string executed against PostgreSQL (Horizon3.ai, 2026-09-01). Because the database connection runs with enough privilege to invoke COPY (...) TO PROGRAM, the injection reaches arbitrary operating-system command execution, not just data disclosure (Horizon3.ai, 2026-09-01). Horizon3.ai reported the flaw to Sangoma on 10 April 2026; a fix shipped in Switchvox 8.4.0.2 on 14 July 2026, and the finding was independently co-discovered by Security Risk Advisors, who published their own advisory on 17 July 2026 (Horizon3.ai, 2026-09-01). Horizon3 deployed internet honeypots from 8 May 2026 (before the patch shipped) specifically to watch for zero-day use; the first genuine exploitation attempt tripped them on 30 August 2026, nearly seven weeks after the patch was already available, from a single source IP dropping reverse shells and enumerating running processes via a base64-encoded top -bn1 pipeline exfiltrated over HTTP (Horizon3.ai, 2026-09-01). CISA added CVE-2026-9586 to its Known Exploited Vulnerabilities catalog on 2026-09-02 (CISA Known Exploited Vulnerabilities catalog, 2026-09-02), and Help Net Security's same-day update reports the same actor has since deployed a second-stage payload that "on a cursory look appeared to be a cryptominer," with dozens of additional source IPs joining in simple scanning and further second-stage installation (Help Net Security, 2026-09-02). Roughly 4,000 Switchvox instances are visible on Shodan, mostly in the United States (Horizon3.ai, 2026-09-01). Horizon3's own researcher assesses the appliance's value to attackers goes beyond the box itself: some deployments hold integration secrets that could let an attacker pivot from external to internal networks using stolen credentials (Help Net Security, 2026-09-02).

The exploitation mechanism generalises beyond this one product: a database role permitted to write server-side files or execute programs via COPY TO PROGRAM turns an ordinary SQL injection into command execution without any xp_cmdshell-style stored-procedure abuse, worth checking for on any PostgreSQL-backed application, not only this one. Triage: the vendor's own component writes injected payloads into /var/log/switchvox/db-quirks.log, which is not a file ordinary phone-notification traffic ever touches; its presence with unfamiliar SQL content is a high-confidence sign of exploitation attempts regardless of whether they succeeded.