Dateline: September 2, 2026
TL;DR: The phone system in your office wiring closet just became a way in. A critical flaw in Sangoma Switchvox, a VoIP platform used by small and mid-size businesses, is now under active attack. It lets an unauthenticated attacker run code on the box from anywhere on the internet. No login. No stolen credentials. Just one crafted request. Researchers confirmed real exploitation attempts starting August 30, and about 4,000 of these systems are sitting exposed online, most of them in the United States.
What Happened?
Back in April, researchers auditing the Sangoma ecosystem picked apart Switchvox and found 12 separate bugs. The worst of them, now tracked as CVE-2026-9586, carries a 9.3 critical severity score.
Here is the mechanics of it. Switchvox runs a feature that lets phones receive call notifications. That feature listens on an open endpoint called /pa, and it needs no authentication. When a request comes in, the system reads an XML message and pulls out a field called PhoneIP. That field goes straight into a database query with no checking at all.
An attacker can stuff SQL commands into it, and because the database runs with superuser rights, those commands can escalate into full code execution on the appliance. In the observed attacks, the intruder dropped a reverse shell and then ran commands to list the machine’s running processes.
Sangoma patched the flaw on July 14 in version 8.4.0.2. Anything still on the older 8.3 build stays wide open.
What’s the Impact?
A phone system does not sound like a crown jewel. That is exactly why it is dangerous. These boxes sit quietly on the network for years, rarely patched, often forgotten by whoever set them up. Once an attacker has code running on one, they have a foothold inside the network with a clear path to move sideways toward more valuable targets.
The exploitation pattern is the worrying part. Attempts came in quick succession from a single source, hitting multiple honeypot systems one after another. That is the signature of automated, opportunistic scanning, not a targeted hit. When one actor sweeps the internet like that, most exposed systems get found fast. If you run Switchvox on the public internet and you have not patched, assume you are on the list.
A hit on any of these means a live infection to remediate. Defanged notation.
176.65.148[.]184
Source of observed exploitation. Hunt network logs to and from the device.
/var/log/switchvox/db-quirks.log
Via SSH, look for injected SQL in the ip_address field.
POST /pa
Unauthenticated. Watch for a <PolycomIPPhone> XML body.
- PostgreSQL COPY … TO PROGRAM running shell commands
- Reverse shell out to an attacker address
- curl exfil of a running-process list
- New accounts, cron jobs, or binaries
How to Avoid This
- Upgrade to Switchvox 8.4.0.2 or later right now. This is the only real fix.
- If you cannot patch this minute, block public access to the /pa endpoint at your firewall and lock the management interface to trusted internal subnets.
- Never expose a VoIP management interface straight to the internet. Put it behind a VPN or a jump host.
- Pull the SSH logs and check /var/log/switchvox/db-quirks.log for injected SQL. Hunt your network logs for the attacker IP in the IOC sheet.
- Look for anything odd on the box: new accounts, unexpected cron jobs, strange outbound connections.
