Hackers are actively exploiting a critical Sangoma Switchvox vulnerability that can allow unauthorised attackers to run commands on systems used to manage business phone networks, security researchers have warned.
Horizon3.ai said its honeypots recorded a series of attacks on August 30, with an attacker attempting to establish a reverse shell on several internet-exposed Switchvox systems.
Switchvox is an enterprise voice-over-internet protocol (VoIP) platform used to configure and monitor business telephone systems. The flaw, tracked as CVE-2026-9586, affects the platform’s publicly accessible /pa endpoint and does not require authentication.
The vulnerability is one of 12 security flaws identified by Horizon3 and reported to Sangoma on April 10. Sangoma addressed the issues in Switchvox version 8.4.0.2, released on July 14.
Attackers target internet-facing Switchvox systems
CVE-2026-9586 is an SQL injection flaw that arises when the endpoint processes XML messages used to notify another phone system about events such as incoming or outgoing calls.
Researchers found that the system takes the PhoneIP value from the message and inserts it directly into a database query without properly safeguarding it. A specially crafted request can therefore be used to inject commands and ultimately execute them on the underlying operating system.
Horizon3 said the activity observed in its honeypots came from a single internet address, 176.65.148.184, and involved attempts against multiple systems in quick succession.
During the attacks, the intruder ran an initial payload, gathered information about the processes running on the Switchvox device and sent the results to a remote server in base64-encoded form.
“Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet-exposed Switchvox instances will be or have already been targeted,” Horizon3 said.
The researchers added that Shodan showed approximately 4,000 Switchvox devices exposed to the internet, with most located in the United States. They said they had not observed active exploitation of the other 11 flaws discovered during their investigation.
Administrators urged to apply Switchvox security update
Administrators have been advised to upgrade to Switchvox 8.4.0.2 or a later release as soon as possible, while also checking whether their systems have already been targeted.
Potential indicators of compromise include unusual entries in /var/log/switchvox/db-quirks.log and network traffic involving 176.65.148.184, particularly connections on port 39323.
The exploitation demonstrates how an exposed communications platform can provide attackers with a route into the systems supporting an organisation’s telephone services, making prompt patching and review of recent activity important for affected operators.
