Switchvox CVE-2026-9586 is a critical unauthenticated SQL injection flaw (CVSS 9.3, CWE-89) in Sangoma's Switchvox enterprise VoIP platform that lets an attacker execute arbitrary code as the PostgreSQL superuser with no credentials, and it is now being exploited in the wild. Horizon3.ai reports valid exploitation attempts beginning August 30, 2026, against roughly 4,000 internet-exposed instances, most of them in the United States. Sangoma patched the flaw in Switchvox 8.4.0.2 on July 14, 2026, so unpatched internet-facing systems are the exposure that matters now.

The technical root is a classic one done badly. The /pa endpoint processes XML content beginning with a PolycomIPPhone tag and concatenates the user-controlled PhoneIP value directly into PostgreSQL queries with no sanitization or parameterization, so a single crafted request lets an unauthenticated attacker run arbitrary SQL, including database operations and full remote code execution. Security Risk Advisors, which found the bug independently in May, said it could extract database contents, modify user records, and escalate to Switchvox web administrator, and CVE-2026-9586 was one of 12 distinct Switchvox vulnerabilities reported to Sangoma in April 2026.

Which Switchvox version is affected and how do I fix it?

The flaw affects Switchvox SMB Edition 8.3 (build 104997), and the fix is to upgrade to Switchvox 8.4.0.2 or later, released July 14, 2026. Because exploitation is live and the attack needs only one unauthenticated request, any internet-reachable Switchvox on the vulnerable build should be patched immediately, and access to the management interface should be restricted while you do.

Why are VoIP appliances such a common target?

Because they are internet-facing, frequently forgotten, and hold a route into the internal network. A phone-system appliance rarely gets the patch urgency of a core server, yet an unauthenticated RCE on one gives an attacker code execution and a database full of user records inside the perimeter. The gap between the July patch and live exploitation in late August is the familiar N-day window: the fix existed for weeks before attackers operationalized it, and the exposed instances that had not updated became the targets.

Our read

CVE-2026-9586 is a textbook N-day: patched in July, exploited at scale by end of August, against internet-exposed appliances nobody rushed to update. That is exactly the window continuous verification exists to close, because the risk here is not a novel zero-day but the ordinary failure to confirm which of your edge appliances are actually on the fixed build. Treat the VoIP platform as the internet-facing attack surface it is, verify its version from the outside, and patch the exposed instances before the next scan finds them for you.

Reporting by The Hacker News; exploitation data per Horizon3.ai and Security Risk Advisors; CVSS and CWE per NVD and CVE.org. Sources linked above.

Related: What is a zero-day? and Continuous verification vs annual pentest.