> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials - URL: https://f4n6.co.uk/security-feed/attackers-exploit-critical-switchvox-flaw-to-deploy-reverse-shells-without-credentials/ - Published: 2026-09-02T08:36:21.000Z - Updated: 2026-09-02T08:36:21.000Z - Author: Jeff Davies - Tags: #security-feed, CVE-2026-9586 ## 1\. Executive summary Attackers are reportedly exploiting CVE-2026-9586 in internet-facing Sangoma Switchvox SMB Edition 8.3 (104997), using unauthenticated SQL injection to obtain remote code execution and deploy reverse shells. CVE-2026-9586 is **CVSS 9.3 CRITICAL**, is **not in CISA KEV**, and has **EPSS 0%**; these verified states differ from the single-source reporting of active exploitation and should be considered together. Exploitation is not attributed to a named actor and there is no evidence of financial-sector-specific targeting, but exposed EMEA deployments face server compromise, database manipulation and authentication-material theft. Sangoma addressed the flaw in **Switchvox 8.4.0.2**, released on 14 July 2026\. [The Hacker News](https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html?ref=f4n6.co.uk) ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. Exposure to CVE-2026-9586 alone does not establish a reportable incident or another item-specific regulatory trigger; affected organisations should reassess this position if investigation confirms compromise or operational impact. ## 3\. Technical analysis & attack chain CVE-2026-9586 is a **CVSS 9.3 CRITICAL** vulnerability, is **not in CISA KEV**, and has **EPSS 0%**. The verified weakness classification is **CWE-89 (SQL Injection)**. The reported exploitation activity is nevertheless operationally significant because it targets an unauthenticated, internet-reachable interface. 1. **Unauthenticated endpoint access:** The attacker sends a crafted XML request to the Switchvox `/pa` endpoint. The vulnerable handler processes XML beginning with `` and accepts a user-controlled `PhoneIP` value. 2. **SQL injection:** Switchvox SMB Edition 8.3 (104997) directly concatenates `PhoneIP` into PostgreSQL queries without sanitisation or parameterisation. A single request can consequently execute arbitrary SQL statements without credentials. 3. **Database-level control:** Successful exploitation reportedly runs with PostgreSQL superuser privileges. Demonstrated capabilities include extracting database contents, modifying user records and escalating accounts to Switchvox web-administrator privileges. 4. **Operating-system command execution:** Researchers demonstrated arbitrary code execution on the underlying server. Honeypot exploitation reportedly resulted in reverse-shell deployment. 5. **Post-exploitation discovery:** Following reverse-shell establishment, attackers reportedly executed Base64-encoded commands to enumerate running processes. The vulnerability affects **Sangoma Switchvox SMB Edition 8.3, build 104997**. Sangoma’s corrected release is **Switchvox 8.4.0.2**. The source reports approximately 4,000 internet-exposed instances, predominantly in the United States; no EMEA-specific exposure count is provided. Security Risk Advisors reportedly demonstrated extraction of the Switchvox cookie-signing key to an external server. Possession of this key could allow an attacker to forge authentication material for arbitrary users. This was presented as a demonstrated exploitation capability, not as a confirmed action in the observed honeypot campaign. No persistence mechanism, privilege-escalation exploit beyond database-backed administrator manipulation, lateral movement, specific reverse-shell protocol, command-and-control infrastructure, or confirmed production data exfiltration was disclosed. No named actor was identified; attribution is therefore unconfirmed. The in-the-wild timeline—valid attempts beginning 30 August 2026—as well as the post-exploitation behaviour and IOC set originate from one published report relaying Horizon3.ai observations. These claims are **single-sourced; verify before enforcement**. [The Hacker News](https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html?ref=f4n6.co.uk) ## 4\. Mitigation & containment ### P1 — within 24 hours - Identify all Switchvox deployments and confirm the exact installed version and build. Treat internet-facing **Switchvox SMB Edition 8.3 (104997)** as immediately exposed. - Upgrade affected systems to **Switchvox 8.4.0.2** or later vendor-supported fixed release. - Until upgraded, remove direct internet exposure or restrict access to the `/pa` interface to explicitly authorised source networks using perimeter firewall, reverse-proxy or access-control policy. - Temporarily block inbound and outbound communication involving `176.65.148[.]184`. Because this IOC is single-sourced, validate against local business requirements and telemetry before permanent enforcement. - On suspected systems, isolate the host while preserving volatile process, connection and authentication evidence. - Review `/var/log/switchvox/db-quirks.log` on devices with SSH enabled for SQL-injection evidence. Correlate timestamps with web-access, firewall, process-execution and outbound-connection logs. - Investigate unexpected reverse shells, Base64-encoded command execution and process-enumeration activity. - If compromise is confirmed, assume that database records, web-administrator accounts and authentication material may be untrusted. ### P2 — within 72 hours - Compare Switchvox user and administrator records against a known-good backup. Investigate unexpected privilege changes, new accounts and modifications to existing accounts. - Review running processes, historical process telemetry and outbound connections for shells or unexplained child processes associated with the Switchvox service. - Rotate affected administrative credentials and invalidate active sessions. - Use Sangoma-supported recovery procedures to rotate or replace the cookie-signing key if theft cannot be excluded. Do not return the system to service until forged-session risk has been addressed. - Rebuild confirmed-compromised appliances from trusted installation media or a known-good image, then apply the fixed release before reconnecting them. - Examine accessible database contents to determine whether confidentiality or integrity was affected. ### P3 — within seven days - Place Switchvox administration and provisioning interfaces behind VPN, controlled management networks or equivalent authenticated access boundaries. - Retain and centralise Switchvox, database, firewall and process telemetry sufficient to investigate unauthenticated requests and subsequent command execution. - Validate that exposure-management scans no longer identify build 104997 or unrestricted access to the vulnerable interface. - Test administrator-account integrity, session invalidation and cookie-signing-key recovery procedures. ## 5\. Indicators of compromise The atomic IOC below is single-sourced; verify before enforcement. | type | value | confidence | source | | ---- | ------------------ | ------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------- | | ipv4 | 176.65.148\[.\]184 | Medium — observed against multiple honeypots; single-sourced | [The Hacker News](https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html?ref=f4n6.co.uk) | ```iocs ipv4 176.65.148[.]184 ``` ### Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------- | | SQL-injection payload targeting /pa through a user-controlled PhoneIP value | /var/log/switchvox/db-quirks.log on devices with SSH enabled; web and reverse-proxy telemetry | Medium — mechanism documented; observed payload details not published | | Reverse-shell deployment following exploitation | Process, network, EDR and firewall telemetry on the Switchvox host | Medium — single-sourced honeypot observation | | Base64-encoded commands used to enumerate running processes | Process-command-line and EDR telemetry | Medium — single-sourced honeypot observation | | Unexpected extraction or outbound transfer of the cookie-signing key | File-access and outbound-network telemetry, where available | Low for active attacks — demonstrated capability rather than confirmed campaign behaviour | | Unauthorised modification of users or elevation to Switchvox web administrator | Switchvox application and database audit records | Medium as an exploitation capability; not confirmed in the observed campaign | ## 6\. Detection Insufficient indicators to author detection rules. ## CVE assessment 1 referenced CVE — 1 critical (CVSS ≥ 9.0) | CVE | CVSS | Exploited | EPSS | Summary | | ------------------------------------------------------------------------------ | ------------ | --------- | ---- | -------------------------------------------------------------------------------------------------------------------------------- | | [CVE-2026-9586](https://nvd.nist.gov/vuln/detail/CVE-2026-9586?ref=f4n6.co.uk) | 9.3 Critical | — | 0% | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes… | ## 7\. Sources - The Hacker News, “Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials,” https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html, 2 September 2026. ## 8\. Adverse Trace position Adverse Trace retains the authoritative assessment of **CVSS 9.3 CRITICAL**, **not in CISA KEV**, and **EPSS 0%**. Despite the absence of KEV listing and the zero EPSS value, reported unauthenticated exploitation leading to reverse shells makes exposed Switchvox SMB Edition 8.3 (104997) a P1 remediation case; the active-exploitation claim and IOC set remain **single-sourced and should be verified before enforcement**. Client impact is conditional on product use and exposure, with no evidence of financial-sector targeting and no confirmed actor attribution. Adverse Trace will monitor for independent corroboration, additional infrastructure, CISA KEV status changes and further vendor guidance. --- [Read the original source →](https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*