Loading vulnerability…
Unauthenticated SQL Injection Leading to RCE in Sangoma Switchvox SMB
CVE-2026-9586 is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition, confirmed in version 8.3 (build 104997). The PhoneConfig::PhoneAppsHandler component forwards XML beginning with <PolycomIPPhone> to tel_notify(), which concatenates the attacker-controlled PhoneIP value into a PostgreSQL query without sanitization or parameterization. The query executes with PostgreSQL superuser privileges, allowing a single crafted HTTP request to perform arbitrary database operations and execute operating-system commands without user interaction. Switchvox 8.4.0.2 fixes the vulnerability. Earlier releases are identified as affected, although the precise historical version range is uncertain.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits database extraction, modification of user records, escalation to Switchvox web-administrator accounts, and arbitrary server-side command execution through PostgreSQL. Demonstrated attacks extracted the cookie-signing key to forge authentication material for arbitrary users and established reverse shells. Observed exploitation also included process enumeration and transmission of collected information to attacker-controlled infrastructure.
If you can’t patch tonight, do this now.
Until upgrading, remove direct internet exposure where feasible and restrict access to the Switchvox web interface and phone-notification endpoint to trusted phone or management networks using firewalls, VPNs, and network segmentation. Review database diagnostic logs for injected SQL, correlate suspicious XML requests with host telemetry, and investigate unexpected outbound connections, shell execution, and process-enumeration activity.
Patch, then assume compromise.
Upgrade Sangoma Switchvox SMB to version 8.4.0.2 or a later supported release. The fixed release was published on July 14, 2026. Because the full range of affected earlier releases is uncertain, do not assume older installations are unaffected. Investigate potentially exposed systems for prior compromise; applying the update does not remove access already obtained by an attacker.
1 exploit validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
112 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.