Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials
- ID
- 20594
- Status
- summarized
- Published
- 02 Sep 2026, 3:08 PM
- Fetched
- 02 Sep 2026, 3:52 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 02 Sep 2026, 3:53 PM
- Tags
- Audience
- developers
What happened
Attackers are actively exploiting CVE-2026-9586 (CVSS 9.3), an unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3 (104997) that allows remote code execution as PostgreSQL superuser without credentials. Sangoma patched the flaw in Switchvox 8.4.0.2 on July 14, 2026, but roughly 4,000 internet-exposed instances—mostly in the U.S.—remain vulnerable, with in-the-wild exploitation observed starting August 30, 2026 deploying reverse shells and running Base64-encoded enumeration commands.
Why it matters
If your organization runs Sangoma Switchvox, patch to 8.4.0.2 immediately and audit for reverse shells or unexpected PostgreSQL superuser activity. For everyone else, this is a reminder that unauthenticated SQL injection endpoints concatenating user input directly into queries remain a live attack vector worth checking in your own codebases.
Discussion angle
The /pa endpoint concatenates a user-controlled PhoneIP value into PostgreSQL queries without sanitization—a textbook SQLi pattern; worth showing as a concrete example of why parameterized queries matter even in XML-processing endpoints.