Your Phone System Was a Root Shell Waiting on a Web Request
A phone system should not become an operating-system shell after one unauthenticated web request. Sangoma Switchvox could, and CISA says attackers are exploiting the flaw.
CVE-2026-9586 is a critical SQL injection that reaches PostgreSQL command execution. An attacker with network access to the Switchvox web interface can execute arbitrary commands as the database superuser and take control of the host without a Switchvox account.
The phone-notification handler trusted attacker input
The attack begins at the /pa endpoint, which handles Polycom phone notifications. Horizon3.ai found that Switchvox concatenated the attacker-controlled PhoneIP XML value directly into a single-quoted PostgreSQL statement.
Because the database accepted stacked queries, the attacker could invoke PostgreSQL’s COPY TO PROGRAM feature and run operating-system commands as the postgres superuser. Command output could then be retrieved through a path-traversal weakness in the /dl endpoint. Its authorization check relied on a hardcoded salt shared across installations.
The result is a complete path from an unauthenticated HTTP request to host-level command execution. The SQL injection is not limited to reading call records or changing database rows.
CISA placed it on a three-day clock
CISA added CVE-2026-9586 to the Known Exploited Vulnerabilities catalogue on 2 September 2026. Federal civilian agencies were given until 5 September to follow the vendor’s remediation guidance. CISA marks known ransomware-campaign use as unknown and requires forensic triage.
The affected range includes Switchvox SMB 8.3 build 104997 and earlier. Sangoma addressed the vulnerability in Switchvox 8.4.0.2, released on 14 July 2026. The patch existed weeks before the exploitation status became public.
Why a PBX compromise reaches beyond phone calls
Switchvox often sits at the centre of call routing, voicemail, recordings, extensions and customer contact data. A compromised appliance can expose communications, redirect calls, create persistence and provide a trusted internal position for follow-on attacks.
VoIP systems are also commonly integrated with directories, customer platforms, email and management networks. Host control can therefore expose credentials and connections that extend well beyond the phone system itself.
What defenders should do now
- Upgrade every affected Switchvox deployment to 8.4.0.2 or a newer supported release.
- Restrict the web interface to trusted management networks and remove direct internet exposure.
- Review HTTP and PostgreSQL logs for unusual requests to
/paand/dl, stacked SQL statements,COPY TO PROGRAMactivity and unexpected command output. - Treat an exposed, vulnerable appliance as potentially compromised. Preserve evidence before rebuilding it.
- Rotate administrator credentials, API tokens and integration secrets stored on or accessible from the PBX.
- Check call-routing rules, voicemail access, extensions, scheduled tasks and outbound connections for unauthorised changes.
The bigger lesson
VoIP appliances are software infrastructure with a dial tone. When a phone-notification handler can cross into a database execution primitive and then into the operating system, patching the PBX belongs on the same emergency queue as an exploited VPN or firewall flaw.
Sources: Horizon3.ai’s technical advisory, Sangoma’s release notes, GitHub Advisory Database, and CISA’s KEV data repository.
