# Sangoma Switchvox Under Active Attack: Unauthenticated SQL Injection Hands Attackers a Shell


## The Threat


Threat actors are actively exploiting a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox, a widely deployed enterprise VoIP platform built on Asterisk. The flaw, tracked as CVE-2026-9586, requires no credentials and no user interaction — an attacker who can reach the Switchvox web interface over the network can inject malicious SQL and pivot directly to remote code execution, dropping reverse shells on affected systems before an alert fires.


What makes this particularly dangerous is the attack chain. SQL injection vulnerabilities in VoIP management interfaces are often treated as read-only data exposure risks, but Switchvox's database layer runs with sufficient OS-level privilege that attackers are weaponizing it for shell access. That transforms a web application vulnerability into full host compromise — with the kind of access that lets them pivot laterally into the corporate network, intercept call recordings, exfiltrate directory data, or deploy ransomware payloads.


Switchvox SMB Edition is positioned at smaller business deployments, where dedicated security operations teams are rarely watching the wire. These organizations tend to run internet-exposed management interfaces — sometimes without VPN gates — making the attack surface both broad and underprotected. Active exploitation in the wild means defenders cannot treat this as a future patch cycle problem.


## Severity and Impact


| Field | Details |

|---|---|

| CVE | CVE-2026-9586 |

| CVSS Score | 9.3 (Critical) |

| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N |

| CWE | CWE-89 — Improper Neutralization of Special Elements used in an SQL Command |

| Attack Complexity | Low |

| Privileges Required | None |

| User Interaction | None |

| Scope | Changed |

| Exploit Status | Actively exploited in the wild |


## Affected Products


  • Sangoma Switchvox SMB Edition

    • - Version 8.3 (build 104997)


    Administrators should verify their build number in the Switchvox admin panel under *Help → About*. Other Switchvox editions and build numbers are not confirmed affected at time of publication, but organizations running any Switchvox version on an internet-exposed interface should treat this as an urgent review item pending further vendor guidance.


    ## Mitigations


    Immediate actions — apply in this order:


  • Patch now. Check Sangoma's portal for an available hotfix or updated build for Switchvox SMB Edition 8.3. If a patch is available, deploy it before taking any other action.
  • Restrict network access. If the Switchvox web management interface is directly reachable from the internet, block it at the perimeter firewall immediately. Place the admin interface behind a VPN or restrict access to known management IP ranges.
  • Audit active sessions. Review Switchvox admin logs and underlying OS authentication logs for signs of unauthorized access, unexpected new accounts, or outbound connections on non-standard ports (indicators of reverse shell activity).
  • Network segmentation. Isolate the Switchvox host from other internal segments using firewall rules. VoIP platforms have no legitimate reason to initiate arbitrary outbound TCP connections — block egress from the host to anything other than SIP trunks and NTP.
  • Monitor for shell indicators. Watch for unusual child processes spawned from the Switchvox web service, unexpected listening ports, or outbound connections to external IPs from the host. A reverse shell will typically appear as a persistent outbound connection on ports like 4444, 1337, or 443.
  • Disable unused web interfaces. If remote web admin access is not actively required, disable it entirely at the application level.

    • Organizations that cannot patch immediately should prioritize the network restriction step above all else. Removing internet exposure collapses the attack surface while a patch is staged.


    ## References


  • Sangoma Switchvox product information: [sangoma.com/products/switchvox](https://www.sangoma.com/products/switchvox)
  • NIST NVD entry for CVE-2026-9586 (pending population): [nvd.nist.gov](https://nvd.nist.gov/)
  • Sangoma security advisories portal: [sangoma.com/support](https://www.sangoma.com/support)

    • ---


    ## HackWire Analysis


    The Switchvox vulnerability fits a well-documented but persistently underappreciated pattern: VoIP infrastructure gets treated as a utility, not an attack surface. Phone systems sit at the intersection of corporate network access, employee directory data, call recordings, and often direct internet exposure — and they run continuously, unmonitored, on hardware that rarely sees the same patching discipline as servers hosting customer-facing applications.


    Sangoma occupies a significant share of the SMB VoIP market through Switchvox and its FreePBX distribution. That installed base is large, heterogeneous, and heavily weighted toward organizations without a full-time security staff. When a CVSS 9.3 flaw with unauthenticated RCE hits that population during active exploitation, the risk-to-remediation gap is at its widest.


    The "reverse shell without credentials" detail in threat actor reports is telling. Sophisticated attackers don't burn RCE on a VoIP box as an end goal — they use it as a beachhead. A compromised Switchvox host has access to internal network segments that SIP trunks and extensions touch, and it frequently holds cleartext or weakly hashed credentials for SIP accounts. From there, attackers can eavesdrop on calls, pivot to adjacent systems, or conduct toll fraud at scale while detection focuses elsewhere.


    Defenders in healthcare, legal, and financial services should treat this as elevated priority. Those sectors run regulated communications through VoIP platforms and face compounding liability if call recordings or directory data are accessed. Patch the host, pull it off public internet, and check your egress rules. The window between "published vulnerability" and "widespread exploitation tooling" is now measured in hours, not weeks.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)