Sangoma VoIP Flaw Actively Exploited to Deploy Reverse Shells

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox enterprise VoIP management platform that leads to remote code execution. Shodan data reveals approximately 4,000 exposed devices on the internet with the majority located within the United States. Horizon3 researchers reported the flaw on April 10, and Sangoma released a fix in version 8.4.0.2 on July 14. Exploitation attempts observed on August 30 involve attackers using a crafted XML request to execute initial payloads, collect data on running processes, and exfiltrate it via base64 encoding to establish a reverse shell. Administrators are advised to check logs for suspicious statements and network connections on port 39323 to a specific malicious IP address. "Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet-exposed Switchvox instances will be or have already been targeted." — Horizon3