Unauthenticated SQL injection in /pa endpoint leads to remote code execution in Sangoma Switchvox (CVE-2026-9586)
Horizon3 published a disclosure today reporting observed active exploitation of this flaw, so teams running unpatched Switchvox systems face unauthenticated remote compromise if they do not update or restrict access now.
The /pa endpoint of Switchvox SMB Edition concatenates the user-controlled PhoneIP value from submitted XML directly into PostgreSQL queries without sanitization. A single crafted unauthenticated request can execute arbitrary SQL against the backend database, including operations that lead to remote code execution on the appliance.
Affected: Sangoma Switchvox SMB Edition >= 8.3 (104997) and < 8.4.0.2
How to Test
Check the Switchvox version — anything from 8.3 (104997) up to but not including 8.4.0.2 (105309) is vulnerable. Review web access logs for crafted XML POST requests to the /pa endpoint, especially those containing anomalous or SQL-syntax content in the PhoneIP field, and verify whether the appliance's web interface is reachable from the internet.
How to Patch
Update to Switchvox version 8.4.0.2 (105309), which resolves the SQL injection per Sangoma's release notes; note that Sangoma's 8.0.1 release notes contain important prerequisites for updating from 7.9.5.2 to 8.x. Until patched, block internet access to the Switchvox web interface, including the /pa endpoint.