CVE-2026-9586

This vulnerability is like a lock that doesn’t require a key: an attacker can send a specially built message to a specific Switchvox network address and trick the system into running attacker code. In reported cases, attackers are using it to create “reverse shells,” which can give them remote control of your server. If your Switchvox system is reachable from outside your trusted network, this can quickly become a full compromise.

This matters if you run Sangoma Switchvox SMB Edition (specifically 8.3 (104997)), because the flaw is unauthenticated and can be triggered over the network. It is a risk when the vulnerable /pa endpoint is reachable from an attacker-controlled network path (for example, exposed to the internet or other untrusted networks). The attack requires no login and no user interaction.

This is RED because attackers are actively exploiting this vulnerability in the wild, including using reverse shells. The weakness is unauthenticated, so a compromised system can be reached without stealing passwords or tricking users. CISA has added it to KEV with an early remediation deadline of 2026-09-05.

Confirm exposure

• Verify the installed product version: check that the system is Sangoma Switchvox SMB Edition 8.3 (104997).
• Determine reachability: confirm whether the Switchvox host (and specifically the /pa endpoint) can be reached from the internet or any untrusted network. Because the flaw is unauthenticated and needs no user action, network exposure is the key risk gate.

Patch / upgrade (required remediation)

• Upgrade Switchvox SMB Edition to the fixed version: 8.4.0.2.
• After upgrading, validate that the system is no longer on 8.3 (104997) and that the relevant service endpoints are functioning normally.

Temporary workaround if you cannot patch immediately

• Restrict network access to Switchvox to only trusted admin networks.
• Block or tightly firewall access to the /pa endpoint from the internet and any untrusted segments.
• Ensure remote management is performed only through approved VPN/bastion paths.

CISA timeline

• CISA KEV remediation due date: 2026-09-05.
• Follow CISA guidance to apply vendor mitigations; if mitigations are unavailable, CISA guidance indicates discontinuing use of the product.

What to monitor

• Look for evidence of malicious outbound connections (reverse shell behavior) originating from the Switchvox host.
• Review logs around requests to the /pa endpoint and check for unusual request patterns.
• Confirm no follow-on compromise indicators appear after patching (e.g., unexpected processes or persistence).

Severity/impact: The vulnerability results in Remote Code Execution (RCE) via database-layer SQL injection (CWE-89). Mechanism: an unauthenticated remote attacker sends a crafted XML request to the /pa endpoint; the PhoneIP field is concatenated into PostgreSQL queries without sanitization or parameterization, allowing arbitrary SQL and code execution. Authentication/user interaction: none required, and no user interaction is required. Exploitation status: listed in CISA KEV and active exploitation has been reported via honeypots, with attackers deploying reverse shells. Patch status: fixed in Switchvox SMB Edition 8.4.0.2. EPSS: reported as 1.1% with flat trend, but real-world exploitation (KEV/news) is the controlling factor for urgency.