Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials

1. Executive summary

Attackers are reportedly exploiting CVE-2026-9586 in internet-facing Sangoma Switchvox SMB Edition 8.3 (104997), using unauthenticated SQL injection to obtain remote code execution and deploy reverse shells. CVE-2026-9586 is CVSS 9.3 CRITICAL, is not in CISA KEV, and has EPSS 0%; these verified states differ from the single-source reporting of active exploitation and should be considered together. Exploitation is not attributed to a named actor and there is no evidence of financial-sector-specific targeting, but exposed EMEA deployments face server compromise, database manipulation and authentication-material theft. Sangoma addressed the flaw in Switchvox 8.4.0.2, released on 14 July 2026. The Hacker News

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. Exposure to CVE-2026-9586 alone does not establish a reportable incident or another item-specific regulatory trigger; affected organisations should reassess this position if investigation confirms compromise or operational impact.

3. Technical analysis & attack chain

CVE-2026-9586 is a CVSS 9.3 CRITICAL vulnerability, is not in CISA KEV, and has EPSS 0%. The verified weakness classification is CWE-89 (SQL Injection). The reported exploitation activity is nevertheless operationally significant because it targets an unauthenticated, internet-reachable interface.

1. Unauthenticated endpoint access: The attacker sends a crafted XML request to the Switchvox /pa endpoint. The vulnerable handler processes XML beginning with <PolycomIPPhone> and accepts a user-controlled PhoneIP value.
2. SQL injection: Switchvox SMB Edition 8.3 (104997) directly concatenates PhoneIP into PostgreSQL queries without sanitisation or parameterisation. A single request can consequently execute arbitrary SQL statements without credentials.
3. Database-level control: Successful exploitation reportedly runs with PostgreSQL superuser privileges. Demonstrated capabilities include extracting database contents, modifying user records and escalating accounts to Switchvox web-administrator privileges.
4. Operating-system command execution: Researchers demonstrated arbitrary code execution on the underlying server. Honeypot exploitation reportedly resulted in reverse-shell deployment.
5. Post-exploitation discovery: Following reverse-shell establishment, attackers reportedly executed Base64-encoded commands to enumerate running processes.

The vulnerability affects Sangoma Switchvox SMB Edition 8.3, build 104997. Sangoma’s corrected release is Switchvox 8.4.0.2. The source reports approximately 4,000 internet-exposed instances, predominantly in the United States; no EMEA-specific exposure count is provided.

Security Risk Advisors reportedly demonstrated extraction of the Switchvox cookie-signing key to an external server. Possession of this key could allow an attacker to forge authentication material for arbitrary users. This was presented as a demonstrated exploitation capability, not as a confirmed action in the observed honeypot campaign.

No persistence mechanism, privilege-escalation exploit beyond database-backed administrator manipulation, lateral movement, specific reverse-shell protocol, command-and-control infrastructure, or confirmed production data exfiltration was disclosed. No named actor was identified; attribution is therefore unconfirmed.

The in-the-wild timeline—valid attempts beginning 30 August 2026—as well as the post-exploitation behaviour and IOC set originate from one published report relaying Horizon3.ai observations. These claims are single-sourced; verify before enforcement. The Hacker News

4. Mitigation & containment

P1 — within 24 hours

• Identify all Switchvox deployments and confirm the exact installed version and build. Treat internet-facing Switchvox SMB Edition 8.3 (104997) as immediately exposed.
• Upgrade affected systems to Switchvox 8.4.0.2 or later vendor-supported fixed release.
• Until upgraded, remove direct internet exposure or restrict access to the /pa interface to explicitly authorised source networks using perimeter firewall, reverse-proxy or access-control policy.
• Temporarily block inbound and outbound communication involving 176.65.148[.]184. Because this IOC is single-sourced, validate against local business requirements and telemetry before permanent enforcement.
• On suspected systems, isolate the host while preserving volatile process, connection and authentication evidence.
• Review /var/log/switchvox/db-quirks.log on devices with SSH enabled for SQL-injection evidence. Correlate timestamps with web-access, firewall, process-execution and outbound-connection logs.
• Investigate unexpected reverse shells, Base64-encoded command execution and process-enumeration activity.
• If compromise is confirmed, assume that database records, web-administrator accounts and authentication material may be untrusted.

P2 — within 72 hours

• Compare Switchvox user and administrator records against a known-good backup. Investigate unexpected privilege changes, new accounts and modifications to existing accounts.
• Review running processes, historical process telemetry and outbound connections for shells or unexplained child processes associated with the Switchvox service.
• Rotate affected administrative credentials and invalidate active sessions.
• Use Sangoma-supported recovery procedures to rotate or replace the cookie-signing key if theft cannot be excluded. Do not return the system to service until forged-session risk has been addressed.
• Rebuild confirmed-compromised appliances from trusted installation media or a known-good image, then apply the fixed release before reconnecting them.
• Examine accessible database contents to determine whether confidentiality or integrity was affected.

P3 — within seven days

• Place Switchvox administration and provisioning interfaces behind VPN, controlled management networks or equivalent authenticated access boundaries.
• Retain and centralise Switchvox, database, firewall and process telemetry sufficient to investigate unauthenticated requests and subsequent command execution.
• Validate that exposure-management scans no longer identify build 104997 or unrestricted access to the vulnerable interface.
• Test administrator-account integrity, session invalidation and cookie-signing-key recovery procedures.

5. Indicators of compromise

The atomic IOC below is single-sourced; verify before enforcement.

ipv4  176.65.148[.]184

Behavioural indicators

6. Detection

Insufficient indicators to author detection rules.

CVE assessment

1 referenced CVE — 1 critical (CVSS ≥ 9.0)

7. Sources

• The Hacker News, “Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials,” https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html, 2 September 2026.

8. Adverse Trace position

Adverse Trace retains the authoritative assessment of CVSS 9.3 CRITICAL, not in CISA KEV, and EPSS 0%. Despite the absence of KEV listing and the zero EPSS value, reported unauthenticated exploitation leading to reverse shells makes exposed Switchvox SMB Edition 8.3 (104997) a P1 remediation case; the active-exploitation claim and IOC set remain single-sourced and should be verified before enforcement. Client impact is conditional on product use and exposure, with no evidence of financial-sector targeting and no confirmed actor attribution. Adverse Trace will monitor for independent corroboration, additional infrastructure, CISA KEV status changes and further vendor guidance.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.