2026-09-03 · view entry permalink →
CVE-2026-9586, Sangoma Switchvox: an unauthenticated XML phone-notification endpoint reaches PostgreSQL COPY TO PROGRAM, and honeypots caught exploitation nearly seven weeks after the patch shipped
Sangoma Switchvox is a VoIP/unified-communications platform built on Asterisk. It exposes an unauthenticated HTTP
endpoint, /pa, handled by PhoneAppsHandler.pm, meant to let supported desk phones receive call-event
notifications. The handler validates only that the POST body starts with the literal string <PolycomIPPhone>,
no further sanitisation, before parsing it as XML via XML::Simple::XMLin() and extracting the PhoneIP field
with no validation, concatenating it directly into an unparameterized SQL string executed against PostgreSQL
(Horizon3.ai, 2026-09-01).
Because the database connection runs with enough privilege to invoke COPY (...) TO PROGRAM, the injection reaches
arbitrary operating-system command execution, not just data disclosure
(Horizon3.ai, 2026-09-01).
Horizon3.ai reported the flaw to Sangoma on 10 April 2026; a fix shipped in Switchvox 8.4.0.2 on 14 July 2026, and
the finding was independently co-discovered by Security Risk Advisors, who published their own advisory on 17 July
2026 (Horizon3.ai, 2026-09-01).
Horizon3 deployed internet honeypots from 8 May 2026 (before the patch shipped) specifically to watch for
zero-day use; the first genuine exploitation attempt tripped them on 30 August 2026, nearly seven weeks after the patch was
already available, from a single source IP dropping reverse shells and enumerating running processes via a
base64-encoded top -bn1 pipeline exfiltrated over HTTP
(Horizon3.ai, 2026-09-01).
CISA added CVE-2026-9586 to its Known Exploited Vulnerabilities catalog on 2026-09-02
(CISA Known Exploited Vulnerabilities catalog, 2026-09-02),
and Help Net Security's same-day update reports the
same actor has since deployed a second-stage payload that "on a cursory look appeared to be a cryptominer," with
dozens of additional source IPs joining in simple scanning and further second-stage installation
(Help Net Security, 2026-09-02).
Roughly 4,000 Switchvox instances are visible on Shodan, mostly in the United States
(Horizon3.ai, 2026-09-01).
Horizon3's own researcher assesses the appliance's value to attackers goes beyond the box itself: some deployments
hold integration secrets that could let an attacker pivot from external to internal networks using stolen
credentials (Help Net Security, 2026-09-02).
The exploitation mechanism generalises beyond this one product: a database role permitted to write server-side
files or execute programs via COPY TO PROGRAM turns an ordinary SQL injection into command execution without any
xp_cmdshell-style stored-procedure abuse, worth checking for on any PostgreSQL-backed application, not only this
one. Triage: the vendor's own component writes injected payloads into /var/log/switchvox/db-quirks.log,
which is not a file ordinary phone-notification traffic ever touches; its presence with unfamiliar SQL content is
a high-confidence sign of exploitation attempts regardless of whether they succeeded.
The PhoneIP field extracted directly from the XML message and directly concatenated into an unparameterized SQL query.
Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet exposed Switchvox instances will be or have already been targeted.
since the initial observations, the same threat actor has been observed downloading second-stage malware onto the system, which on a cursory look appeared to be a cryptominer, he shared. Also, since his post was published, dozens of additional source IPs have been observed exploiting the honeypots to include simple scanning payloads and also more second stage malware installation.