Patch Sangoma Switchvox now — an unauthenticated flaw is being exploited

If your office runs Sangoma Switchvox SMB Edition, this is the week to stop putting off that update. A critical, unauthenticated vulnerability in Switchvox — tracked as CVE-2026-9586 — is being actively exploited to drop reverse shells on internet-facing systems, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog.

Switchvox is a common choice in exactly the shops this site is written for: county offices, small police departments, and community banks that want an on-prem phone system without a full-time telecom admin. If that’s you, check your version today.

What’s vulnerable

CVE-2026-9586 is a SQL injection flaw in a Switchvox web endpoint that handles phone-provisioning requests. It doesn’t require a login: an attacker who can reach the endpoint over the network can send a single crafted request and run arbitrary commands against the backend PostgreSQL database, with a path from there to running commands on the underlying host. Researchers rate it 9.3 out of 10 (critical), and it affects Switchvox SMB Edition builds before version 8.4.0.2.

Sangoma shipped the fix — version 8.4.0.2 — on July 14, 2026. Security researchers who found the bug published technical details afterward, and by late August, honeypots run by the researchers began recording real exploitation attempts. CISA added the vulnerability to its KEV catalog on September 2, 2026, which it reserves for vulnerabilities with confirmed active exploitation. Security researchers have identified roughly 4,000 Switchvox systems reachable from the internet, most of them in the United States.

If your Switchvox has been reachable from the internet and unpatched since late August, treat it as potentially compromised, not just vulnerable. Exploitation doesn’t require you to have done anything wrong beyond running an old build with a public IP.

Check whether you’re exposed

Two things matter here: your version, and your exposure.

1. Check your version. Log into the Switchvox admin interface and check the software version against 8.4.0.2. Anything older is vulnerable.
2. Check your exposure. From outside your network (a phone on cellular data works), try browsing to your Switchvox’s public IP or hostname on the ports it listens on. If it answers, it’s reachable from the internet, and this vulnerability doesn’t require a login to hit it.

If you’re not sure whether your Switchvox has a public IP or port forward pointed at it, that’s worth finding out regardless of this specific vulnerability — see this site’s guide to locking down an exposed on-prem PBX for how to check.

How to fix it

• Update to 8.4.0.2 or later now. This is the actual fix, and it existed before the exploitation started. Follow Switchvox’s normal update process, and take a backup or snapshot first as you would for any update.
• If you can’t update immediately, take the system off the public internet. Remove the port forward or firewall rule that exposes the web/provisioning interface, and require a VPN for any remote administration or provisioning until you’ve patched.
• If you were exposed and unpatched during the exploitation window, don’t stop at patching. Check for unfamiliar processes or scheduled tasks on the Switchvox server, review outbound connections for anything unexpected, and change any credentials stored on or used to manage that box. If anything looks off, get a second set of eyes on it before you conclude it’s clean.

Patching closes the hole. It doesn’t undo anything that already happened through it.

Sources

• CISA: Adds Seven Known Exploited Vulnerabilities to Catalog, September 2, 2026 — confirms CVE-2026-9586’s addition to the KEV catalog based on confirmed active exploitation.
• Horizon3.ai: CVE-2026-9586 — Sangoma Switchvox RCE — the researchers’ disclosure, with the vulnerability mechanism, affected versions, and fixed version.
• Help Net Security: Exploitation of Sangoma Switchvox flaw is underway — reporting on the honeypot detections and exploitation timeline.
• BleepingComputer: Hackers exploit Sangoma Switchvox flaw to deploy reverse shells — reporting on exploitation activity and exposed instance count.