{"id":2660,"date":"2026-09-02T18:57:27","date_gmt":"2026-09-02T18:57:27","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=2660"},"modified":"2026-09-02T18:57:27","modified_gmt":"2026-09-02T18:57:27","slug":"attackers-exploit-critical-switchvox-flaw-to-deploy-reverse-shells-without-credentials","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=2660","title":{"rendered":"Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Sep 02, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution.<\/p>\n

The vulnerability in question is CVE-2026-9586<\/a><\/strong> (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as the PostgreSQL superuser without credentials. Sangoma released patches<\/a> for the flaw in Switchvox 8.4.0.2 on July 14, 2026.<\/p>\n

\u00abAn unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The \/pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization,\u00bb according to a description of the flaw on CVE.org.<\/polycomipphone><\/p>\n

\u00abAn unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.\u00bb<\/p>\n

Horizon3.ai said<\/a> CVE-2026-9586 is among the 12 distinct vulnerabilities in Switchvox that were reported to Sangoma in April 2026, and that it is now seeing valid exploitation attempts in the wild against the flaw starting August 30, 2026. There are about 4,000 instances exposed to the internet, most of them located in the U.S.<\/p>\n

The same vulnerability was independently discovered<\/a> and reported<\/a> by Security Risk Advisors (SRA) Labs in May.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

\u00abAs an unauthenticated attacker, we were able to perform arbitrary database operations, including extracting database contents, modifying user records, and escalating privileges to Switchvox web administrators,\u00bb SRA Labs said. \u00abWe also successfully executed arbitrary code on the server, invoking a reverse shell on the target machine.\u00bb<\/p>\n

In one example highlighted by SRA Labs, successful exploitation of CVE-2026-9586 makes it possible to exfiltrate the cookie signing key to an external server, thereby allowing an attacker to forge authentication material for arbitrary users.<\/p>\n

\"\"<\/a><\/div>\n

The exploitation efforts targeting its honeypots involve the deployment of reverse shells on compromised systems, followed by running Base64-encoded commands to enumerate running processes. The autonomous penetration testing platform has shared the following indicators of compromise –<\/p>\n