{"id":2337,"date":"2026-09-03T05:30:00","date_gmt":"2026-09-03T05:30:00","guid":{"rendered":"https:\/\/netguide.io\/news\/?p=2337"},"modified":"2026-09-03T06:09:16","modified_gmt":"2026-09-03T06:09:16","slug":"switchvox-cve-2026-9586-sql-injection-rce-exploited","status":"publish","type":"post","link":"https:\/\/netguide.io\/news\/en\/2026\/09\/03\/switchvox-cve-2026-9586-sql-injection-rce-exploited\/","title":{"rendered":"Critical Switchvox Flaw CVE-2026-9586: Attackers Hijack VoIP Systems via SQL Injection"},"content":{"rendered":"<div id=\"netgu-1256748231\" class=\"netgu-before-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"3494115342\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div><p class=\"wp-block-paragraph\"><strong>Attackers can seize full control of Sangoma&#8217;s Switchvox VoIP phone system without any authentication \u2013 and that is already happening. Since 30 August 2026, honeypots have recorded active attacks against the CVE-2026-9586 flaw. On 1 September, researchers at Horizon3.ai published the technical details, sharply lowering the barrier to entry for further attackers.<\/strong><\/p>\n\n<h3 class=\"wp-block-heading\">What makes the flaw so dangerous<\/h3>\n\n<p class=\"wp-block-paragraph\">CVE-2026-9586 is an unauthenticated SQL injection that can be escalated to remote code execution. The unprotected <code>\/pa<\/code> endpoint processes XML messages from IP phones and writes the <code>PhoneIP<\/code> field directly into a PostgreSQL query with no sanitisation whatsoever. A single crafted HTTP request is enough to run commands with database superuser privileges. The flaw carries a critical CVSS 4.0 score of 9.3.<\/p><div id=\"netgu-3435097243\" class=\"netgu-content netgu-entity-placement\"><aside class=\"deals-top deals-top--compact\">\r\n\r\n\t\t\t<h3 class=\"deals-top__title\">Top-Deals<\/h3>\r\n\t\r\n\t\t\t<ul class=\"deals-top__list\">\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/amazon-kindle-scribe-64-gb-neuartiges-display-mit-gleichmaessigem-rahmen-schreib-einfach-in-buecher-und-dokumente-mit-notizbuchzusammenfassung-mit-premi\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/kindle_shopall_310mmTall-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Amazon Kindle Scribe (64 GB) \u2013 Neuartiges Display mit gleichm\u00e4\u00dfigem Rahmen | Schreib einfach in B\u00fccher und Dokumente | Mit Notizbuchzusammenfassung | Mit Premi\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">329.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>421.02 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-22%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/philips-hue-white-ambiance-e27-3er-starter-set-inkl-smart-button-dimmbar-alle-weissschattierungen-steuerbar-via-app-kompatibel-mit-amazon-alexa-echo-echo\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/61pZ0xD9KGL._AC_SL1500_-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Philips Hue White Ambiance E27 3er Starter Set inkl. Smart Button, dimmbar, alle Wei\u00dfschattierungen, steuerbar via App, kompatibel mit Amazon Alexa (Echo, Echo\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">77.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>129.99 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-40%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/philips-hue-e27-filament-grosse-edison-lampe-white-ambiance-alle-weisstoene-550-lm-dimmbar-leuchtmittel-fuer-das-hue-lichtsystem-app-und-sprachsteuerung-s\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/61UiXJLhChL._AC_SL1500_-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Philips Hue E27 Filament Gro\u00dfe Edison Lampe | White Ambiance, Alle Wei\u00dft\u00f6ne, 550 lm, Dimmbar, Leuchtmittel f\u00fcr das Hue Lichtsystem, App- und Sprachsteuerung, S\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">29.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>39.90 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-25%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/ninja-foodi-max-dual-zone-heissluftfritteuse-95l-airfryer-2-faecher-mit-zange-antihaftbeschichtung-spuelmaschinenfeste-koerbe-6-in-1-amazon-exklusiv-kupfe\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/61FZ31gLeL._AC_SL1400_-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Ninja Foodi MAX Dual Zone Hei\u00dfluftfritteuse, 9,5L Airfryer, 2 F\u00e4cher, mit Zange, Antihaftbeschichtung, sp\u00fclmaschinenfeste K\u00f6rbe, 6-in-1, Amazon Exklusiv, Kupfe\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">149.99 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>172.47 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-13%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t\t\t<li class=\"deals-top__item\">\r\n\t\t\t\t\t<a class=\"deals-top__link\" href=\"https:\/\/netguide.io\/deals\/de\/deals\/samsung-galaxy-book4-edge-ai-laptop-156-zoll-display-16gb-ram-snapdragon-x-plus-prozessor-notebook-512gb-speicher-copilot-pc-sapphire-blue-3-jahre-her\/\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t<img class=\"deals-top__image\" src=\"https:\/\/netguide.io\/news\/wp-content\/uploads\/sites\/15\/2026\/09\/41HJCRoes1L-150x150.jpg\" alt=\"\" width=\"52\" height=\"52\" loading=\"lazy\" \/>\r\n\t\t\t\t\t\t\r\n\t\t\t\t\t\t<span class=\"deals-top__body\">\r\n\t\t\t\t\t\t\t<span class=\"deals-top__name\">Samsung Galaxy Book4 Edge AI-Laptop, 15,6-Zoll-Display, 16GB RAM, Snapdragon X Plus Prozessor, Notebook 512GB Speicher, Copilot+ PC, Sapphire Blue, 3 Jahre Her\u2026<\/span>\r\n\r\n\t\t\t\t\t\t\t<span class=\"deals-top__meta\">\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-top__price\">579.00 \u20ac<\/span>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<s>967.97 \u20ac<\/s>\r\n\t\t\t\t\t\t\t\t\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<span class=\"deals-discount\">-40%<\/span>\r\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t\t<\/span>\r\n\r\n\t\t\t\t\t\t<span class=\"deals-top__temperature\">\r\n\t\t\t\t\t\t\t0\u00b0\r\n\t\t\t\t\t\t<\/span>\r\n\t\t\t\t\t<\/a>\r\n\t\t\t\t<\/li>\r\n\t\t\t\t\t<\/ul>\r\n\r\n\t\t\t\t\t<p class=\"deals-top__more\">\r\n\t\t\t\t<a href=\"https:\/\/netguide.io\/deals\/\">Alle Deals ansehen \u2192<\/a>\r\n\t\t\t<\/p>\r\n\t\t\t<\/aside>\r\n<\/div>\n\n<h3 class=\"wp-block-heading\">Affected systems and ongoing attacks<\/h3>\n\n<p class=\"wp-block-paragraph\">The vulnerable release is Switchvox SMB Edition 8.3 (build 104997). According to Horizon3.ai, roughly 4,000 appliances are reachable from the internet, most of them in the United States. In observed attacks, threat actors pulled down reverse shells and then ran reconnaissance commands to exfiltrate system information. The incident remains ongoing \u2013 this is a preliminary assessment.<\/p>\n\n<h3 class=\"wp-block-heading\">What administrators should do now<\/h3>\n\n<ul class=\"wp-block-list\"><li>Update immediately to <strong>Switchvox 8.4.0.2<\/strong> (released 14 July 2026).<\/li><li>Block the <code>\/pa<\/code> endpoint from external access via firewall or reverse proxy until the patch is applied.<\/li><li>Review logs for suspicious POST requests to <code>\/pa<\/code> and unusual outbound connections.<\/li><\/ul>\n\n<p class=\"wp-block-paragraph\"><strong>Sources:<\/strong> <a href=\"https:\/\/horizon3.ai\/attack-research\/disclosures\/cve-2026-9586-sangoma-switchvox-rce\/\" target=\"_blank\" rel=\"noopener\">Horizon3.ai \u2013 CVE-2026-9586 Disclosure<\/a>, <a href=\"https:\/\/securityonline.info\/sangoma-switchvox-cve-2026-9586-rce\/\" target=\"_blank\" rel=\"noopener\">SecurityOnline<\/a>, <a href=\"https:\/\/www.sentinelone.com\/vulnerability-database\/cve-2026-9586\/\" target=\"_blank\" rel=\"noopener\">SentinelOne Vulnerability Database<\/a>.<\/p><div id=\"netgu-1364959466\" class=\"netgu-after-content netgu-entity-placement\"><script async src=\"\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-6258556257245998\" crossorigin=\"anonymous\"><\/script><ins class=\"adsbygoogle\" style=\"display:block;\" data-ad-client=\"ca-pub-6258556257245998\" \ndata-ad-slot=\"4559785002\" \ndata-ad-format=\"auto\"><\/ins>\n<script> \n(adsbygoogle = window.adsbygoogle || []).push({}); \n<\/script>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Sangoma&#8217;s Switchvox VoIP phone system has been under active attack since late August: the unpatched flaw CVE-2026-9586 (CVSS 9.3) lets attackers fully take over the server without authentication. A patch has been available since July.<\/p>\n","protected":false},"author":1,"featured_media":1722,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[],"tags":[],"class_list":["post-2337","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry"],"brizy_media":[],"_links":{"self":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2337","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/comments?post=2337"}],"version-history":[{"count":1,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2337\/revisions"}],"predecessor-version":[{"id":2374,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/posts\/2337\/revisions\/2374"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media\/1722"}],"wp:attachment":[{"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/media?parent=2337"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/categories?post=2337"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/netguide.io\/news\/wp-json\/wp\/v2\/tags?post=2337"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}