Sangoma Switchvox Under Attack: A 9.3-Severity Hole in Your Phone System

Your phone system is now a remote-code-execution target, and attackers already know it

A critical flaw in Sangoma Switchvox, the management software behind a lot of enterprise VoIP deployments, is under active exploitation. CVE-2026-9586 carries a CVSS score of 9.3. It is an unauthenticated SQL injection, so the attacker does not need credentials or a phished user. One request to the right endpoint is enough.

SecurityWeek reported this week that Horizon3.ai observed the exploitation and published indicators of compromise. CISA then added the flaw to its Known Exploited Vulnerabilities catalog. When the vendor ecosystem moves that fast, the message is blunt: someone is inside vulnerable phone systems right now, somewhere.

The bug itself is almost lazy

The root cause is a line of code that should never have shipped. An endpoint that processes XML takes a user-supplied value called PhoneIP and pastes it straight into PostgreSQL queries. No sanitization. No parameterized statements. Just string concatenation on an internet-facing service.

The NIST advisory puts the impact plainly: an unauthenticated remote attacker can execute arbitrary SQL against the backend database using a single crafted request, and the request path reaches remote code execution on the server. A PBX that gives up shell access is no longer a phone. It is a foothold on your internal network with a dial plan attached.

A crowded week on the KEV catalog

The Switchvox entry arrived alongside six other actively exploited flaws, and the vendor list is a who’s-who of the network edge. Two SonicWall SMA 1000 zero-days that allow unauthenticated remote code execution. The JFrog Artifactory bug that lets attackers mint admin tokens. A request smuggling flaw in Starlette, the ASGI framework underneath a lot of the Python AI services people deployed this year. A command injection defect in the orchestration platform Kestra, flagged as exploited by Microsoft. And an authentication bypass in LiteLLM, the gateway that routes traffic to model APIs, which Wiz honeypots caught attackers probing last week.

Federal agencies got three days to patch most of the batch, with the Kestra and Starlette flaws given two weeks under BOD 26-04. Nobody is forcing private companies to meet that clock, which is exactly why the clock matters.

Why this lands harder in the South African context

Sangoma gear is common in local businesses, and the country has old scars from PBX compromise. Toll-fraud waves in previous years cost South African companies millions in fraudulent call charges after attackers took over poorly defended phone systems. What has changed is the ceiling. A cracked PBX used to run up a phone bill. A cracked PBX with a 9.3 RCE chain gets the attacker into the network that hosts the file server, the switch configuration, and the accounting share.

These devices are exposed by design. Staff need softphones from home, so the management plane faces the internet. Weak or default admin passwords are routine. The device almost never sits in a segmented network, and it almost never shows up in the patch cycle because whoever owns the phones does not talk to whoever owns the servers.

What to do this week

• Patch first. Update Switchvox to the fixed release Sangoma has published. If you are running an older unmanaged box, that is now an emergency, not an IT backlog item.
• Check your exposure. Pull up your perimeter configuration and answer one question honestly: is the PBX management interface reachable from the public internet? If yes, close that before the patch even lands.
• Hunt with the published IOCs. Horizon3 released them precisely so defenders can tell whether they already have a problem. Review database logs for queries hitting the PhoneIP parameter path.
• Segment the voice network. Phone infrastructure belongs on its own segment with tightly controlled routes to wherever it legitimately needs to go.

I keep coming back to how cheap this attack is. No zero-day research, no spear-phishing campaign, just an unsanitized string on a box most organizations bought once and never revisited. The exploitation is confirmed, the fix is available, and the boundary between “phone network” and “data network” is the line where this ends badly.

eHawu perspective

At eHawu, we treat forgotten edge devices as first-class attack surface. Our network-layer controls keep management planes off the public internet, segment voice and data traffic by default, and give security teams a single pane over devices that no one thought to monitor. If your PBX, firewall, or box of unpatched gadgets is facing the open internet, that is the conversation to have first, before the next KEV entry has your vendor’s name in it.