CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability
Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Overview
Sangoma Switchvox SMB Edition contains an unauthenticated SQL injection flaw in its phone notification endpoint that allows a remote attacker to execute arbitrary SQL against the backend PostgreSQL database and achieve full remote code execution on the host. No credentials or user interaction are required. Versions from 8.2.2.1 up to but not including 8.4.0.2 are affected, and researchers have confirmed active exploitation attempts against internet-exposed instances.
Vulnerability details
The vulnerable component is the unauthenticated /pa HTTP endpoint, handled by PhoneAppsHandler.pm. When the endpoint receives a POST body beginning with the XML tag PolycomIPPhone, it extracts the PhoneIP field and concatenates it directly into a PostgreSQL query string without sanitization or parameterization. Because the database connection runs as a PostgreSQL superuser, the injected SQL executes with full database privileges. This is a classic CWE-89 trust-boundary failure: user-controlled input crosses into a query context with no escaping, quoting, or prepared-statement boundary to prevent interpretation as SQL.
An attacker sends a single crafted HTTP POST to the /pa endpoint containing a malicious XML body where the PhoneIP field carries a stacked SQL payload. Using PostgreSQL's COPY TO PROGRAM construct, the injected statement passes an OS command to the database process, producing a reverse shell on the Switchvox host. No authentication, prior access, or user interaction is required. Researchers have observed exploitation in the wild, with attackers following the initial shell with process enumeration commands exfiltrated to attacker-controlled infrastructure.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Inspect /var/log/switchvox/db-quirks.log for SQL entries containing stacked statements, COPY TO PROGRAM, or shell utilities such as nc, curl, or bash originating from the auto_phone_config query context.
- Review web or CGI access logs for POST requests to the /pa endpoint where the body contains PolycomIPPhone XML from sources that are not known Polycom phone IP addresses on the local network.
- Monitor for unexpected outbound connections from the Switchvox host process to external IPs, particularly on non-standard ports, which may indicate a reverse shell established via COPY TO PROGRAM.
Remediation
Additional hardening
- Upgrade Switchvox SMB Edition to version 8.4.0.2 or later, which contains the vendor patch for this vulnerability.
- Restrict network access to the /pa endpoint at the perimeter or host firewall so that only known Polycom phone IP addresses can reach it; the endpoint requires no authentication and is the sole attack surface.
- Place the Switchvox management interface behind a VPN or firewall that blocks direct internet access; approximately 4,000 instances are currently internet-exposed and have been actively targeted.
- If immediate patching is not possible, consider disabling or blocking the /pa endpoint entirely until the update can be applied, accepting the loss of phone notification functionality as a temporary compensating control.
Key dates
References
- https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-9586
- https://labs.sra.io/posts/switchvox/
- https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586
Frequently asked questions
Does CVE-2026-9586 affect my FedRAMP authorization?
If Sangoma Switchvox runs inside your authorization boundary, CVE-2026-9586 affects your Federal Risk and Authorization Management Program (FedRAMP) authorization directly. The vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, and the September 5, 2026 remediation deadline has already passed. An unpatched KEV inside your boundary is an assessor finding. An overdue one is visible to your assessor and sponsoring agency now. You either close it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-9586?
Knox does not patch your software. Remediating Sangoma Switchvox is your responsibility under the FedRAMP shared-responsibility model. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus continuous compliance monitoring and audit-artifact coverage to document the fix for your next assessment. The work of applying the patch is yours. Managing the compliance posture around it is not something you have to do alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including ones like CVE-2026-9586. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the earliest possible window to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-9586's remediation deadline of September 5, 2026 has passed. What happens now?
An unremediated CVE-2026-9586 is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid ground.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
