Active Exploitation of CVE-2026-9586 in Sangoma Switchvox VoIP Platform

Threat actors are actively exploiting a critical vulnerability in Sangoma Switchvox, a widely deployed VoIP platform. According to reporting from BleepingComputer, the flaw tracked as CVE-2026-9586 is an unauthenticated SQL injection vulnerability. This means that an attacker can inject malicious SQL queries into the Switchvox web interface without needing valid credentials.

The exploitation of this SQL injection flaw leads to remote code execution (RCE). Once exploited, attackers can deploy reverse shells to the compromised system. A reverse shell allows the attacker to gain interactive command-line access to the underlying operating system of the Switchvox appliance, effectively granting them control over the VoIP platform.

The active exploitation has been observed in the wild starting around September 2, 2026. The ability to achieve remote code execution on a corporate VoIP system represents a significant risk, as it could allow attackers to intercept communications, manipulate call routing, or pivot into broader corporate networks.

Sangoma has acknowledged the vulnerability and released security updates to address CVE-2026-9586. The company has urged all administrators to apply the latest firmware or software updates to mitigate the risk. Details regarding the specific versions affected and the exact mitigation steps are outlined in the official Sangoma security advisory.

Security teams managing Switchvox deployments should prioritize patching and ensure that management interfaces are not exposed to untrusted networks until updates are applied.