Attackers Exploit Critical Switchvox Flaw to Deploy Reverse Shells Without Credentials

Summary

A critical SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox allows unauthenticated remote code execution. Attackers are actively exploiting this flaw, deploying reverse shells and exfiltrating data. Patches are available, and organizations are urged to update their systems.

Key Takeaways

1. Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution.
2. The vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as the PostgreSQL superuser without credentials.
3. Horizon3.ai said CVE-2026-9586 is among the 12 distinct vulnerabilities in Switchvox that were reported to Sangoma in April 2026, and that it is now seeing valid exploitation attempts in the wild against the flaw starting August 30, 2026.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 20% of statements classified as editorial or subjective
• Claims: 10% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article relies on technical details and reports from security firms, providing specific CVE numbers and CVSS scores. It cites multiple sources for the vulnerability discovery and exploitation, enhancing its credibility. However, the article is from a cybersecurity news outlet, which may have a vested interest in reporting on such vulnerabilities.

Bias assessment: Technical Security Reporting. The article focuses on the technical aspects of a cybersecurity vulnerability and its exploitation. It presents information factually, citing security researchers and official vulnerability databases. The language is objective and informative, aiming to educate readers about a specific threat.

Note: This article details a critical security vulnerability. While based on technical reports, always verify with official advisories and implement recommended security measures.

Credibility flag: Technical, Verify

Claimed Facts (8)

• This statement presents specific technical details about the vulnerability, including its identifier, score, and impact, which are verifiable facts.
• This is a factual statement about the release of a security patch by the vendor.
• This is a direct quote from a technical description of the vulnerability, presented as factual information.
• This statement attributes a finding and observation to a specific security research firm, presenting it as a factual report.
• This provides a quantitative estimate of the vulnerability's exposure, presented as a factual observation.
• This is a factual statement about the independent discovery and reporting of the vulnerability by another entity.
• This provides a specific technical indicator of compromise, presented as a factual observation for detection.
• This is a specific piece of network intelligence presented as a factual indicator of malicious activity.

Opinions (5)

• This is a statement of capability and findings from SRA Labs, presented as their experience and assessment.
• This is a statement of successful action and outcome from SRA Labs, reflecting their findings.
• This describes a potential consequence of exploitation, presented as a possibility and assessment by SRA Labs.
• This is a researcher's belief and assessment of the likelihood of widespread targeting, based on observed activity.
• While the flagging itself is a fact, the implication that this is definitive proof of malicious intent is an interpretation.

Claims (2)

• While presented as a direct quote, the absolute certainty of 'can execute' without further context or demonstration can be seen as a strong claim that requires verification in a real-world scenario.
• This describes a process that, while plausible, is presented as a definitive action without direct evidence of the specific commands or their success in this particular exploitation.

Key Sources

• The Hacker News — Cybersecurity News Outlet
• Security Risk Advisors (SRA) Labs — Cybersecurity Research Firm
• Zach Hanley — Security Researcher