Switchvox CVE-2026-9586: your phone system runs code

Switchvox CVE-2026-9586 is an unauthenticated SQL injection in Sangoma's small-business phone system that ends in remote code execution, and attackers started firing it at honeypots on August 30. The fix shipped on July 14. That 47-day gap is the actual story here, because the boxes getting hit are sitting in the back offices of businesses that do not have a patch calendar for their phone system — because nobody told them a phone system needed one.

What actually happened

Horizon3 reported 12 vulnerabilities to Sangoma on April 10, 2026. Sangoma shipped a pre-release patch on April 21 and the public fix, version 8.4.0.2, on July 14. Security Risk Advisors, which found overlapping issues independently, published its advisory on July 17.

The bug is plain. Switchvox exposes an unauthenticated /pa endpoint — phone provisioning — handled by PhoneAppsHandler.pm. It accepts an XML body opening with <PolycomIPPhone>, pulls the PhoneIP field straight out of the XML, and concatenates it into a PostgreSQL query with no parameterization. CWE-89, textbook. The query runs with PostgreSQL superuser privileges, which is what converts a data-read into command execution.

Exploitation began August 30, per Horizon3, from a single IP hitting multiple honeypots in quick succession and dropping reverse shells, then enumerating running processes. BleepingComputer reports roughly 4,000 Switchvox devices exposed on the internet, mostly in the United States. Horizon3's read: most internet-exposed instances have been targeted or will be. CISA added it to KEV on September 2.

Why an office appliance matters for your business

We have run a business. We know how the phone system got there: a vendor installed it, it worked, and it left everyone's mind for four years. It is not in your asset inventory. It is not in your monitoring. Nobody owns its patch cycle, because it is furniture.

It is also a Linux box with a database, on your network, answering the internet. An attacker with a shell on it is inside your LAN, next to the workstations and the NAS, with a foothold that no endpoint agent is watching. Voice traffic and call records are the least of it.

Do three things this week. Upgrade to 8.4.0.2 — it closes this plus the other eleven Horizon3 findings. Get the web interface and /pa off the public internet; if remote handsets need provisioning, restrict the endpoint to your handset subnets at the firewall rather than leaving it open to the world. Assume compromise if you were exposed and unpatched after August 30 — look for unexpected processes and outbound connections, and rotate anything reachable from that segment.

Then widen the question. The phone system, the printer server, the NAS, the door controller, the RMM agent — every one of them is a networked computer that somebody sold you as an appliance. We covered PaperCut for exactly this reason. Appliances are the part of the stack where the patch exists and nobody applies it.

Sources: Horizon3 disclosure, Security Risk Advisors advisory, BleepingComputer, CISA KEV alert, September 2.