1. Executive summary
Sangoma Switchvox — an enterprise VoIP/unified communications platform built on Asterisk — contains CVE-2026-9586, a critical unauthenticated SQL injection vulnerability (CVSS 9.3, CWE-89) affecting Switchvox SMB Edition 8.3 (build 104997). A single crafted request allows an unauthenticated remote attacker to execute arbitrary SQL against the backend PostgreSQL database, escalating to database operations and remote code execution. The flaw is actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalogue on 2026-09-02 with a federal remediation due date of 2026-09-05, and press reporting confirms attackers are deploying reverse shells against internet-exposed instances without credentials. EMEA financial services clients running internet-facing Switchvox should treat this as an emergency: the product is an edge-exposed PBX, exploitation is pre-authentication, and EPSS (1%) understates current activity — KEV listing is the operative risk signal.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Confirmed active exploitation of an internet-exposed, pre-authentication RCE path in a VoIP platform that, if exploited at a client, would plausibly meet major-incident thresholds (full system compromise of a communications platform) | Clients with compromised Switchvox instances must assess the incident against their DORA Art. 19 reporting clock from the point compromise is established, not from patch deployment |
| DORA Art. 24: digital operational resilience testing — general requirements | CISA KEV listing with a 2026-09-05 due date creates a concrete, externally-imposed remediation deadline for a known-exploited edge component | Clients should evidence that internet-facing estate discovery and KEV-driven patch verification are inside their Art. 24 testing programme; a missed KEV deadline on an exposed PBX is a testing-control failure, not just a patching failure |
No NIS2 or UK NIS article is directly engaged beyond generic incident/patching duties; the item contains no fact specific to supply-chain security measures or UK OES/RDSP scope.
3. Technical analysis & attack chain
Vulnerability mechanism. CVE-2026-9586 is an unauthenticated SQL injection (CWE-89, per NVD) in Sangoma Switchvox SMB Edition 8.3 (build 104997). The injection is reachable remotely without authentication and targets the backend PostgreSQL database. A single crafted request is sufficient to execute arbitrary SQL statements; the CISA advisory states the impact extends to arbitrary database operations and remote code execution. The Hacker News corroborates the RCE outcome, reporting that attackers are deploying reverse shells without credentials. The precise injection point (specific parameter, endpoint, or Switchvox web component) is not disclosed in the available source material.
Attack chain (confirmed steps)
- Reconnaissance/target selection. The threat actor identifies internet-exposed Sangoma Switchvox instances. Help Net Security describes the campaign as actively targeting internet-exposed instances; deployment models include on-premises, cloud, and virtualised infrastructure, so exposure is not limited to one hosting pattern.
- Initial access. The attacker sends a single crafted, unauthenticated request to the Switchvox web application, exploiting CVE-2026-9586 to inject arbitrary SQL into the backend PostgreSQL database.
- Execution. Injected SQL enables arbitrary database operations and, per CISA and The Hacker News, remote code execution on the underlying host — The Hacker News specifically reports reverse shell deployment without credentials.
- Post-compromise. Not characterised in the available sources. No malware family, persistence mechanism, C2 infrastructure, or exfiltration activity is described. Do not assume data theft or extortion; the sources do not support it.
Scope and versioning caveat. The affected version is identified as Switchvox SMB Edition 8.3 (build 104997). The sources do not enumerate the full affected-version range, the fixed version, or whether other Switchvox editions (e.g., Enterprise) are affected. Help Net Security describes the flaw as "recently patched," implying a vendor fix exists, but no fixed build number appears in the provided material — obtain it from Sangoma directly before closing this item.
Sourcing confidence. Active exploitation is multi-source corroborated (CISA KEV listing, Help Net Security, The Hacker News). The reverse-shell payload detail is single-sourced to The Hacker News; verify against your own telemetry before treating reverse-shell deployment as the expected payload in your environment. No threat actor is named in any source; no attribution claim is made, and none should be inferred.
4. Mitigation & containment
P1 — within 24 hours
- Enumerate exposure. Identify all Sangoma Switchvox deployments across the estate (on-prem, cloud, virtualised) and determine which are internet-facing. Any SMB Edition 8.3 (104997) instance reachable from the internet should be treated as presumptively compromised.
- Apply the vendor patch immediately. The flaw is described as recently patched; obtain the current fixed build from Sangoma and upgrade all Switchvox instances, prioritising internet-exposed ones. The CISA KEV due date is 2026-09-05 — three days from issuance — which reflects the urgency, not a licence to wait.
- Remove internet exposure. If a patch cannot be applied within 24 hours, place the Switchvox web interface behind VPN/zero-trust access or restrict it at the perimeter firewall to administrative VLANs only. CISA's required action explicitly permits discontinuing use where mitigations are unavailable.
- Hunt for compromise on exposed instances before and after patching: review PostgreSQL query logs for anomalous statements, and look for unexpected outbound connections consistent with reverse-shell activity (per the single-sourced reporting above).
P2 — within 72 hours
- Patch internal instances even if not internet-exposed; the vulnerability is unauthenticated, so any attacker with network reachability to the Switchvox web interface can exploit it.
- Follow CISA's Forensics Triage Requirements (referenced in the KEV entry) for any instance that was exposed during the exploitation window — the vulnerability has been exploited since at least the KEV addition date, and the actual window is unknown.
- Validate post-patch that the Switchvox web application no longer accepts the crafted request pattern; confirm build version via the admin console.
P3 — within 7 days
- Add Switchvox to the internet-facing asset register and KEV monitoring feed so future Sangoma advisories trigger the same P1 workflow automatically.
- Review PBX/UC platform placement in network architecture: session border controllers and administrative interfaces for VoIP platforms should not be directly internet-exposed as a standing control.
5. Indicators of compromise
No indicators of compromise available in the source material. The sources describe exploitation behaviour but provide no atomic indicators (no IPs, domains, hashes, or request signatures).
Behavioural indicators
| Behaviour | Where to observe | Confidence |
|---|---|---|
| Crafted unauthenticated SQL injection requests against the Switchvox web application | Switchvox web server access logs; WAF logs; PostgreSQL query logs showing anomalous/unexpected SQL statements | High (mechanism confirmed by CISA and vendor advisory) |
| Reverse shell initiated from the Switchvox host following exploitation | EDR process telemetry; outbound firewall/NetFlow logs showing unexpected outbound connections from the PBX host | Medium (single-sourced to The Hacker News; verify before enforcement) |
6. Detection
Insufficient indicators to author detection rules. The sources provide no request signatures, payload strings, file artefacts, or command-line indicators tied to the exploitation. A rule keyed on the CVE identifier or product name would detect reporting about the threat, not the threat itself. Recommend instead: alert on anomalous SQL statement patterns in PostgreSQL logs originating from the Switchvox application account, and on outbound network connections from PBX hosts to previously unseen destinations.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-9586 | 9.3 Critical | ⚠ KEV 2026-09-02 | 1% | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes… |
7. Sources
- NVD — CVE-2026-9586 — Sangoma Switchvox SQL Injection Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-9586 — 2026-09-01
- CISA Known Exploited Vulnerabilities catalogue (via NVD record) — CVE-2026-9586 entry, added 2026-09-02, due date 2026-09-05 — https://nvd.nist.gov/vuln/detail/CVE-2026-9586 — 2026-09-02
- The Hacker News — Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials — https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html — 2026-09
- Help Net Security — Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586) — https://www.helpnetsecurity.com/2026/09/02/exploitation-of-sangoma-switchvox-flaw-underway-cve-2026-9586/ — 2026-09-02
8. Adverse Trace position
This is a critical (CVSS 9.3), actively exploited, unauthenticated SQL injection leading to RCE in an internet-exposed PBX — for any EMEA financial services client running Sangoma Switchvox SMB Edition 8.3 with internet-facing deployment, this is a same-day patch-or-isolate decision, not a routine cycle item. The KEV listing with a 2026-09-05 due date and multi-source confirmation of in-the-wild exploitation make the risk unambiguous; the EPSS score of 1% should be disregarded as lagging indicator. Two gaps constrain our assessment: the fixed build number and full affected-version range are not in the available material, and the reverse-shell payload claim rests on a single vendor-adjacent report — we will monitor Sangoma's advisory and CISA for the fixed version, any released IOCs, and emerging attribution, and will reissue this advisory if the affected-version scope widens beyond SMB Edition or if concrete indicators surface.
Published via PulseTrace — Adverse Trace threat intelligence.