CVE-2026-9586: Sangoma Switchvox Unauthenticated SQL Injection Enables Remote Code Execution

Background

Sangoma Switchvox is an on-premises unified communications and VoIP phone system aimed at small and mid-sized businesses. It bundles call routing, voicemail, auto-attendants, and a web-based administration console, and it is commonly deployed as an appliance or virtual machine that sits directly on a company’s network — frequently with its management interface reachable from the internet so remote offices and remote workers can reach extensions and administer the system.

Because Switchvox stores call detail records, voicemail metadata, extension configuration, and user credentials in a backend PostgreSQL database, any vulnerability that lets an outsider talk to that database directly bypasses the application’s entire access-control model. CVE-2026-9586 is exactly that kind of vulnerability: an unauthenticated SQL injection flaw that Sangoma and CISA both treat as a direct path to full system compromise.

Technical Mechanism

CVE-2026-9586 is classified under CWE-89 (SQL Injection). According to the KEV catalog entry, the flaw allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request.

The mechanics follow the standard SQL injection attack pattern, with an unusually severe outcome:

1. An attacker identifies an endpoint in the Switchvox web application that accepts user-supplied input and incorporates it into a SQL query without proper parameterization or sanitization.
2. Because the endpoint does not require authentication, the attacker needs no valid credentials, session token, or prior access to reach the vulnerable code path.
3. A single crafted HTTP request containing malicious SQL syntax is enough to manipulate the query’s logic — for example, to break out of an intended string or numeric context and append additional SQL clauses.
4. CISA’s advisory notes this extends to database operations and remote code execution — meaning the injection point is powerful enough to reach PostgreSQL functionality (such as stacked queries, large object functions, or COPY-based command execution primitives available to a sufficiently privileged database role) that can be abused to write files or execute commands on the underlying host, not merely to read or modify rows.

This combination — unauthenticated, single-request, and chainable to RCE — is what accounts for the maximum-tier CVSS score of 9.8.

Real-World Exploitation Evidence

CVE-2026-9586 was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on 2026-09-02. KEV listing by definition means CISA has confirmed evidence of active exploitation in the wild, not merely theoretical risk.

Regarding ransomware: the KEV record lists knownRansomwareCampaignUse as “Unknown.” This means CISA has not confirmed use of this vulnerability in ransomware campaigns at this time — it does not mean ransomware use has been ruled out, only that it is not yet documented.

No specific threat actor, intrusion set, or campaign name has been publicly attributed to exploitation of this CVE in the data available at the time of writing. Its KEV listing confirms active exploitation in the wild, but attribution detail is not yet public. Organizations should not wait for attribution before remediating — attacker identity is a secondary concern to shutting off access to an unauthenticated SQL injection with a documented RCE path.

Impact Assessment

A CVSS 9.8 score at the critical tier reflects complete compromise potential: an unauthenticated attacker on the network can achieve full confidentiality, integrity, and availability loss against the affected system.

What an attacker achieves:

• Confidentiality: Direct read access to the PostgreSQL database exposes call detail records, voicemail metadata, extension-to-user mappings, and potentially stored credentials or credential hashes for the Switchvox admin interface and connected directory services.
• Integrity: An attacker can modify call routing rules, redirect or intercept calls, alter voicemail, or tamper with billing and CDR data used for compliance and auditing.
• Availability: Destructive SQL operations (dropping tables, corrupting the schema) can take the entire phone system offline.
• Beyond the database: CISA’s own advisory language ties this flaw to remote code execution, meaning the ultimate impact is not confined to data — an attacker can plant persistence on the Switchvox host itself.

Sector-specific risk: VoIP systems like Switchvox sit at the intersection of business operations and compliance. Organizations in healthcare, finance, and legal services that route sensitive conversations through Switchvox face call-content exposure risk in addition to the general RCE risk. Because Switchvox appliances are often internet-facing by design (to support remote extensions), the “unauthenticated, single request” nature of this bug makes mass internet scanning and exploitation straightforward for any attacker who has mapped exposed Switchvox instances.

Affected Versions

The KEV data provided does not include an explicit affected-version range. Sangoma’s release notes for version 8.4.0.2 (dated 14 July 2026) are referenced as the vendor’s remediation guidance.

Organizations should consult the Sangoma Switchvox 8.4.0.2 release notes directly for the definitive affected-version list and build-level patch mapping, as the provided KEV record does not enumerate specific version boundaries.

Remediation Steps

CISA’s required action for this entry is to “apply mitigations in accordance with vendor instructions,” in compliance with BOD 26-04 and its associated Forensics Triage Requirements. Concretely:

1. Patch immediately. Upgrade all Switchvox deployments to version 8.4.0.2 or later, per Sangoma’s release notes.

   # On the Switchvox appliance/VM admin console
   # System > Updates > Check for Updates
   # Apply update to 8.4.0.2 or later, then reboot services

2. Restrict network exposure until patched. If the Switchvox admin or API interface is reachable from the public internet, place it behind a VPN or restrict access via firewall allow-lists to known management IP ranges.

   # Example iptables rule limiting access to Switchvox web/API port to a trusted management subnet
   iptables -A INPUT -p tcp --dport 443 -s 10.10.0.0/24 -j ACCEPT
   iptables -A INPUT -p tcp --dport 443 -j DROP

3. Conduct forensic triage on any internet-facing Switchvox instance that was unpatched prior to 2026-09-02, per CISA’s BOD 26-04 Forensics Triage Requirements — this includes reviewing PostgreSQL logs and web server access logs for anomalous query patterns predating the patch.
4. Rotate credentials stored in or alongside the Switchvox database (admin passwords, API keys, SIP trunk credentials) if forensic review cannot rule out prior access.
5. Discontinue use of the product if mitigations cannot be applied in time, per BOD 26-04 cloud/unavailable-mitigation guidance — this applies to organizations unable to patch before the CISA deadline.

Detection Guidance

Exact IDS/WAF signatures for this specific injection point have not been published in the data available at the time of writing; the following are general detection strategies appropriate to an unauthenticated SQLi against a PostgreSQL-backed web application:

• Web server / reverse proxy access logs: Look for requests to Switchvox web endpoints containing SQL metacharacters and keywords in parameters — ', --, ;, UNION SELECT, OR 1=1, pg_sleep(, COPY, or encoded variants of these strings.
• PostgreSQL logs: If query logging is enabled, review for statements originating from the application’s service account that deviate from expected prepared-statement patterns, especially multi-statement (“stacked”) queries or calls to large-object or file-system-adjacent functions.
• Anomalous outbound connections: An RCE chain stemming from database-level command execution may result in the Switchvox host making unexpected outbound connections (reverse shells, payload downloads) — monitor host-based or network egress logs for connections to unfamiliar IPs immediately following suspicious HTTP requests.
• Unexpected new OS processes spawned by the PostgreSQL service account, which would indicate successful command execution via the database.

Because exact signatures are not publicly documented for this CVE, organizations should treat vendor/IDS feed updates (Snort/Suricata community rules, WAF vendor rule packs) as the authoritative source once available, and prioritize patching over detection as the primary control.

Timeline

References

• Sangoma Switchvox 8.4.0.2 Release Notes (14 July 2026)
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements
• NVD — CVE-2026-9586