Attackers Exploit Critical Sangoma Switchvox SQL Injection Flaw CVE-2026-9586 to Deploy Reverse Shells Without Credentials
Administrators of VoIP systems and IT security teams face an urgent new threat: a critical vulnerability in Sangoma Switchvox that enables remote code execution without any credentials. The flaw, identified as CVE-2026-9586 and rated CVSS 9.3, has already been exploited in real-world attacks to deploy reverse shells since August 30, 2026.
The vulnerability resides in the HTTP endpoint /pa, which processes XML requests. The system inserts the PhoneIP value directly into PostgreSQL queries without proper sanitization or parameterization. This classic CWE-89 SQL injection pattern allows attackers to run arbitrary database commands and escalate to full system command execution with PostgreSQL superuser privileges.
Observed attack activity includes the immediate opening of reverse shells and basic reconnaissance. Attackers use Base64-encoded commands to enumerate running processes and map the compromised server environment. One IP address linked to the campaign is 176.65.148.184. Forensic traces may appear in the log file /var/log/switchvox/db-quirks.log, which records attempted SQL injections and subsequent actions.
Patch Availability and Timeline
Sangoma released the corrective update in Switchvox 8.4.0.2 on July 14, 2026. The patch addresses the injection flaw along with additional web portal fixes. The disclosure timeline shows the initial report to the vendor on April 10, 2026, the patch release in mid-July, and confirmed exploitation by late August.
Thousands of Switchvox instances remain reachable from the internet, with a notable concentration in the United States. Organizations should prioritize immediate upgrades to version 8.4.0.2 or later, especially for any deployments exposed to untrusted networks.
Recommended Mitigations and Detection
- Apply the Switchvox 8.4.0.2 update without delay.
- Restrict access to the HTTP service using network segmentation, VPNs, or access control lists until patching is complete.
- Monitor outbound connections for anomalies, particularly attempts to reach 176.65.148.184 or the use of tools such as nc and unexpected bash invocations from web services.
- Inspect logs for signs of post-exploitation and rotate all associated credentials if compromise is suspected.
Additional technical details are available from The Hacker News and Horizon3.ai research reports, as well as official Sangoma release notes.
Related articles
WordPress Issues Critical Security Update 7.1.2 Five Days After Previous Patch
WordPress has released version 7.1.2 to fix a new critical vulnerability that was not addressed in the 7.1.1 update issued just five days earlier. The flaw, tracked as CVE-2026-87902, is a path traversal issue rated Critical that can be exploited without authentication. It resides in the page template resolution process and allows execution of arbitrary local PHP files located outside the theme directory, provided certain conditions such as the presence of a page- prefixed directory in the parent or child theme are met. The update was published on September 22, 2026, and affects the prior release from September 17. Administrators are urged to apply the patch immediately to prevent potential remote code execution.
F5 BIG-IP APM Vulnerability CVE-2026-94127 Allows Remote Code Execution, Already Exploited in the Wild
F5 has disclosed a critical heap-based buffer overflow vulnerability in BIG-IP Access Policy Manager that is already being actively exploited. The flaw, tracked as CVE-2026-94127, affects systems configured as an OAuth authorization server with both an access policy and OAuth profile applied to a virtual server. Successful exploitation can result in arbitrary code execution from crafted network traffic. The issue also impacts appliance mode configurations. F5 rates the vulnerability 9.3 under CVSS v4.0 and 9.8 under CVSS v3.1, classifying it as Critical. The company discovered the flaw internally and has confirmed real-world exploitation, urging immediate patching and compromise assessment.
ZeroNights 2026 Conference Program Highlights Offensive Security Research Across 30+ Talks
The ZeroNights 2026 conference program has been announced, featuring three tracks, four stages, and over 30 speakers focused on advanced offensive techniques, vulnerability discovery, and secure development practices. The event will take place on September 30, 2026, in Saint Petersburg at LOFT#7. Key presentations on the Offensive Track cover femtocell security, mobile operator advertising API exploitation, Trusting Trust attacks on the JDK, Rust memory safety limitations, and AMD SMM vulnerabilities including CVE-2025-54502. Additional talks examine Qualcomm BootROM flaws such as CVE-2026-25262, Linux kernel exploitation via CVE-2026-31695, Semtech LR11xx chip vulnerabilities, and reverse engineering of Dexprotector. The program emphasizes practical research into binary exploitation, side-channel analysis, and cross-chain bridge attacks.
BigDiskBuster Exploit Blocks Microsoft Defender Updates on All Supported Windows Versions
Security researcher Abdelhamid Naseri, known as Nightmare Eclipse, has released BigDiskBuster, a new exploit targeting Microsoft Defender that prevents the platform and antivirus signatures from receiving updates. The tool leaves Windows systems protected only by an outdated threat database while the interface continues to display normal status indicators. BigDiskBuster works across all currently supported Windows versions but requires continuous background execution. The researcher has published the source code on GitHub and acknowledged that the current implementation contains bugs requiring further refinement. The technique closely resembles the earlier UnDefend tool released in April, which similarly interfered with Defender update mechanisms. Naseri has disclosed nearly a dozen proof-of-concept exploits since April affecting Microsoft Defender, BitLocker, and other Windows components, including ShieldCrash, ShieldBreak, RoguePlanet, LegacyHive, BlueHammer, RedSun, YellowKey, and Plasma variants. Microsoft has not yet issued a patch for BigDiskBuster and previously criticized uncoordinated public disclosures of working exploits.