Attackers have begun exploiting a critical vulnerability in Sangoma Switchvox, a widely used VoIP platform. The flaw, tracked as CVE-2026-9586, allows unauthenticated SQL injection, which can lead to remote code execution on vulnerable systems. Security reports confirm active exploitation in the wild, with attackers deploying reverse shells to gain control over affected instances.
What happened
The vulnerability affects Sangoma Switchvox, a VoIP solution used by enterprises for communication infrastructure. CVE-2026-9586 enables attackers to bypass authentication and execute arbitrary SQL commands, which can then be leveraged to run malicious code remotely. Once exploited, the flaw allows the deployment of reverse shells, giving attackers persistent access to compromised systems. The source did not specify the number of affected organizations or the timeline of the attacks beyond their active status.
What we don't know yet
Details about the attack vectors, such as whether specific configurations or versions are targeted, remain unclear. The source also did not provide information on mitigation steps or patches released by Sangoma. Additionally, the geographic distribution or industry sectors most impacted by these exploits have not been disclosed.
Companies mentioned
Automated pipeline · Security
Synthesized from 1 industry feed on 2 Sep 2026. Passed independent editor verification (score 85/100) before publication. Style guide v1.4.
Sources
Decision trail
- Checking for duplicates — New story No recent or in-pipeline article covers Sangoma Switchvox exploitation.
- Checking for duplicates — New story pre_write:; No previously published or in-pipeline article covers this Sangoma Switchvox vulnerability.
- Writing the article — Brief only thin sources; quick-read mode
- Writing the article — Draft created article_id=497 slug=sangoma-switchvox-flaw-exploited-for-reverse-shells quick_read=1
-
Editor review — Approved
- Score: 85/100
- Factual grounding: The draft states 'Security reports confirm active exploitation in the wild' but the provided source does not explicitly mention 'security reports'—it only states 'Attackers are actively exploiting'. This phrasing could imply broader confirmation than the single source provides.
- Factual grounding: The draft claims 'the source did not specify the number of affected organizations or the timeline of the attacks beyond their active status', which is accurate but could be clarified to note that no such details exist in the source at all (not just unspecified).
- Style compliance: The standfirst ('Active attacks target unauthenticated SQLi bug in VoIP platform') is slightly redundant with the title and could be more specific (e.g., 'Enterprises urged to check VoIP systems as attackers exploit unauthenticated SQLi flaw').
- Audience relevance and notability: The draft does not explicitly address why hosting/cloud/email professionals should care beyond generic 'enterprise VoIP'. A brief note on potential infrastructure risks (e.g., lateral movement, SIP abuse) would strengthen relevance.
- Generating reader Q&A — Generated 3 items
- Assigning hero image — Rejected library image #27: The candidate describes a generic 'computer hardware' image with an unrelated alt text mentioning 'nvidia blackwell gpu server rack data center,' which does not match the article's topic about a Sangoma Switchvox VoIP platform vulnerability. There is no clear connection to VoIP, SQL injection, or reverse shells, and the alt text is misleading.
- Assigning hero image — Unsplash unsplash_id=A9jp72Owzvs q=SQL injection attack visualization picker=The article discusses a SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox being exploited for reverse she
- Linking related stories — Linked 5 relations from 430 candidates
- Publishing — Published sangoma-switchvox-flaw-exploited-for-reverse-shells
- Mastodon — Posted https://mstdn.social/@hostingpaper/117203663698930540
Discussion · coming soon
Be the first to join the thread when community discussion launches.