SECURITY_THREAT_PULSE
LIVE
LAST UPDATED
FIRST SEEN
5 SOURCES ON THIS EVENT
▲ ACT NOWCVE-2026-9586 · CVSS 9.3

Sangoma Switchvox: attackers can read or change its database

AFFECTSSangoma Switchvox

OFFICIAL NAME: Sangoma Switchvox SQL Injection Vulnerability

WHAT IT IS · BUSINESS SOFTWAREIt runs day-to-day business work such as finance, printing, phones or manufacturing.

DO THIS FIRSTAsk the vendor or the team that owns it whether the fix is in. Not sure if you use it? Send this page to your IT provider or security lead and ask.

TECHNICAL SUMMARY Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

WHY THIS VERDICT Attacks are confirmed. The vulnerability is 107 days old, so current versions are being attacked. Ready-made attack tools are public. The severity score is critical (9.3).

HIGHEST CONFIRMED RUNG
EXPLOITED
CISA KEV
LISTED
EXPLOIT CODE
READY TO USE
// EVIDENCE LADDER

How far has it climbed?

CONFIRMED
REPORTED
NO EVIDENCE

  1. 01 TALK

    □ NO EVIDENCE YET
    NEWEST EVIDENCE NONE YET

    No evidence yet.

    SRC: NONE YET

  2. 02 EXPOSED

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    We have no source that counts exposed systems yet. Internet scan data needs a partnership we do not have. No evidence here does not mean nothing is exposed.

  3. 03 TRIED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Attacks that worked are confirmed (step 4), so attempts count as confirmed too.

  4. 04 EXPLOITED

    ■ CONFIRMED
    NEWEST EVIDENCE · 2 INDEPENDENT SOURCES

    Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. CISA Vulnrichment marks CVE-2026-9586 as actively exploited.

  5. 05 DAMAGE

    □ NOT TRACKED YET
    NO SOURCE FOR THIS STEP YET

    Breach notices and filings rarely name the flaw that was used, so we cannot link them to this event yet. No evidence here does not mean no harm.

// THE CLOCK

When each thing happened

  1. DISCLOSED
    CVE-2026-9586 published
  2. EXPLOIT CODE PUBLIC
    CIRCL Vulnerability-Lookup sightings
  3. FIRST ATTACK REPORT
    CISA Known Exploited Vulnerabilities
  4. CISA KEV LISTING
    CISA KEV listing
  5. US FEDERAL DEADLINE
    CISA deadline for US federal agencies
Attacks were reported 47 days after disclosure. CISA listed it 47 days after disclosure.

THE FIX

CISA's instruction: apply the vendor's fix, or stop using the product if no fix exists. The deadline CISA set for US federal agencies, Sep 5, 2026, has passed. It is a US government deadline; use it as a guide.

// ASK YOUR TEAM

Questions to ask this week

// TIMELINE · PACIFIC TIME

How it unfolded

  1. Attack activity. JUL 17, 2026
    CISA Vulnrichment marks CVE-2026-9586 as actively exploited
  2. Attack activity. SEP 1, 2026
    Sangoma Switchvox SQL Injection Vulnerability
  3. SEP 1, 2026
    Vulnerability CVE-2026-9586 confirmed by a researcher (CIRCL sighting)
  4. SEP 2, 2026
    2 public GitHub repositories claim a proof of concept for CVE-2026-9586

SOURCES

  1. [1] nuclei-templates: Nuclei scan template: Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection, OCT 24
  2. [2] PoC-in-GitHub: 2 public GitHub repositories claim a proof of concept for CVE-2026-9586, SEP 2
  3. [3] CIRCL Vulnerability-Lookup sightings: Vulnerability CVE-2026-9586 confirmed by a researcher (CIRCL sighting), SEP 1
  4. [4] CISA Known Exploited Vulnerabilities: Sangoma Switchvox SQL Injection Vulnerability, SEP 1
  5. [5] CVE List V5 and CISA Vulnrichment: CISA Vulnrichment marks CVE-2026-9586 as actively exploited, JUL 17