Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
Summary: Attackers are exploiting CVE-2026-9586, a critical unauthenticated SQL injection flaw (CVSS 9.3) in Sangoma Switchvox SMB Edition 8.3 (104997) that lets a remote attacker run arbitrary SQL against the backend PostgreSQL database and execute code as the PostgreSQL superuser without credentials. Sangoma patched the flaw in Switchvox 8.4.0.2 on July 14, 2026, and Horizon3.ai reports valid exploitation attempts in the wild starting August 30, 2026, against roughly 4,000 internet-exposed instances, most in the U.S.
Key Takeaway: SRA Labs demonstrated that exploiting this flaw yields a reverse shell on the target and lets an attacker exfiltrate the cookie signing key, which is enough to forge authentication material for arbitrary users, including Switchvox web administrators. Horizon3.ai's Zach Hanley said that given the quick succession of exploit attempts across multiple honeypots from the same source IP, most internet-exposed Switchvox instances will be or have already been targeted.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-9586
- Related
- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability Known Exploited Vulnerabilities · Sep 02, 2026