--- schema: 1 kind: vulnerability title: "CVE-2026-9586 — Sangoma Switchvox: an unauthenticated XML phone-notification endpoint reaches PostgreSQL COPY TO PROGRAM, and honeypots caught exploitation nearly seven weeks after the patch shipped" headline: "A field meant to hold a phone's IP address is concatenated straight into SQL, and the database role has enough privilege to execute programs" summary: > CISA added CVE-2026-9586 (CVSS 4.0 9.3) to its Known Exploited Vulnerabilities catalog on 2026-09-02, confirming active exploitation of an unauthenticated SQL injection in Sangoma Switchvox that reaches remote code execution via PostgreSQL's COPY TO PROGRAM. Horizon3.ai's honeypots caught the first exploitation attempts on 2026-08-30 — nearly seven weeks after Switchvox 8.4.0.2 patched the flaw — with a cryptominer now confirmed as a second-stage payload and dozens of additional source IPs joined in since. Roughly 4,000 instances are visible on Shodan. discovered_at: "2026-09-03T05:11:00Z" updated_at: null event_date: "2026-08-30" run_id: 2026-09-03T0410Z-intel priority: high immediate_action: null tags: [vulnerabilities, sqli, rce, pre-auth, actively-exploited, cisa-kev, patch-available] regions: [global, us] sectors: [telco, public-sector] entities: [] techniques: [T1190, T1059.004, T1496] affected_products: ["Sangoma Switchvox"] cves: - id: CVE-2026-9586 cvss: "9.3 (CVSS4.0)" epss: null type: sqli vector: zero-click auth: pre-auth status: [exploited, cisa-kev, patch-available] affected: "Sangoma Switchvox ≤ 8.4.0.1 (SMB Edition 8.3 line confirmed)" fixed: "8.4.0.2" sources: - url: "https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/" publisher: "Horizon3.ai (Zach Hanley)" date: "2026-09-01" role: primary - url: "https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/" publisher: "Help Net Security" date: "2026-09-02" role: corroborating - url: "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" publisher: "CISA (Known Exploited Vulnerabilities catalog)" date: "2026-09-02" role: corroborating closed_sources: [] evidence: - quote: "The PhoneIP field extracted directly from the XML message and directly concatenated into an unparameterized SQL query." publisher: "Horizon3.ai (Zach Hanley)" - quote: "Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet exposed Switchvox instances will be or have already been targeted." publisher: "Horizon3.ai (Zach Hanley)" - quote: "since the initial observations, the same threat actor has been observed downloading second-stage malware onto the system, which on a cursory look appeared to be a cryptominer, he shared. Also, since his post was published, dozens of additional source IPs have been observed exploiting the honeypots to include simple scanning payloads and also more second stage malware installation." publisher: "Help Net Security, citing Horizon3.ai's Zach Hanley" verification: multi-source sourcing_note: null confidence: high references: [] deep_dive: false deep_dive_category: null org_triage: null classification: reliability: B credibility: 1 watchlist_hit: false actions: - "Upgrade every internet-exposed Sangoma Switchvox instance to ≥ 8.4.0.2 now; where an appliance was exposed before patching, check /var/log/switchvox/db-quirks.log for injected SQL payloads, since the flaw has been under active exploitation with cryptominer deployment since 30 August." updates: [] migrated_from: null --- Sangoma Switchvox is a VoIP/unified-communications platform built on Asterisk. It exposes an unauthenticated HTTP endpoint, `/pa`, handled by `PhoneAppsHandler.pm`, meant to let supported desk phones receive call-event notifications. The handler validates only that the POST body starts with the literal string `` — no further sanitisation — before parsing it as XML via `XML::Simple::XMLin()` and extracting the `PhoneIP` field with no validation, concatenating it directly into an unparameterized SQL string executed against PostgreSQL ([Horizon3.ai, 2026-09-01](https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/)). Because the database connection runs with enough privilege to invoke `COPY (...) TO PROGRAM`, the injection reaches arbitrary operating-system command execution, not just data disclosure ([Horizon3.ai, 2026-09-01](https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/)). Horizon3.ai reported the flaw to Sangoma on 10 April 2026; a fix shipped in Switchvox 8.4.0.2 on 14 July 2026, and the finding was independently co-discovered by Security Risk Advisors, who published their own advisory on 17 July 2026 ([Horizon3.ai, 2026-09-01](https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/)). Horizon3 deployed internet honeypots from 8 May 2026 — before the patch shipped — specifically to watch for zero-day use; the first genuine exploitation attempt tripped them on 30 August 2026, nearly seven weeks after the patch was already available, from a single source IP dropping reverse shells and enumerating running processes via a base64-encoded `top -bn1` pipeline exfiltrated over HTTP ([Horizon3.ai, 2026-09-01](https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/)). CISA added CVE-2026-9586 to its Known Exploited Vulnerabilities catalog on 2026-09-02 ([CISA Known Exploited Vulnerabilities catalog, 2026-09-02](https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json)), and Help Net Security's same-day update reports the same actor has since deployed a second-stage payload that "on a cursory look appeared to be a cryptominer," with dozens of additional source IPs joining in simple scanning and further second-stage installation ([Help Net Security, 2026-09-02](https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/)). Roughly 4,000 Switchvox instances are visible on Shodan, mostly in the United States ([Horizon3.ai, 2026-09-01](https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/)). Horizon3's own researcher assesses the appliance's value to attackers goes beyond the box itself: some deployments hold integration secrets that could let an attacker pivot from external to internal networks using stolen credentials ([Help Net Security, 2026-09-02](https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/)). The exploitation mechanism generalises beyond this one product: a database role permitted to write server-side files or execute programs via `COPY TO PROGRAM` turns an ordinary SQL injection into command execution without any `xp_cmdshell`-style stored-procedure abuse — worth checking for on any PostgreSQL-backed application, not only this one. **Triage:** the vendor's own component writes injected payloads into `/var/log/switchvox/db-quirks.log`, which is not a file ordinary phone-notification traffic ever touches — its presence with unfamiliar SQL content is a high-confidence sign of exploitation attempts regardless of whether they succeeded. **Defender takeaway:** patch every internet-exposed Switchvox instance to 8.4.0.2 now; given honeypot telemetry already shows broad, non-targeted scanning for this flaw, treat an unpatched exposed instance as under active attack rather than merely at risk.