CVE-2026-9586 is an unauthenticated SQL injection in Sangoma Switchvox SMB Edition, CVSS 9.3. The /pa endpoint concatenates the user-controlled PhoneIP value straight into PostgreSQL queries with no parameterisation, which yields arbitrary SQL and then code execution as the PostgreSQL superuser. No credentials required.

Sangoma fixed it in 8.4.0.2 on 14 July 2026. Exploitation in the wild was observed on 30 August — 47 days later.

The part that survives the update

SRA Labs, who found the flaw independently in May, did not stop at reading the database. They used the access to exfiltrate the cookie signing keys, and then forged authentication cookies for arbitrary users.

Think about what that means for the remediation plan.

Installing 8.4.0.2 closes the injection point. It does not change the signing key. If an attacker took that key before you patched, they can still mint a valid session for any account on the system — as an administrator, through the front door, with no exploit involved and nothing in the logs that looks like an attack.

This is the same shape as the Rails flaw where the fix only works if your native image library is new enough: the patch is necessary and it is not the whole job. Anywhere a vulnerability leaks a long-lived secret, the patch and the rotation are two separate tasks, and only one of them is on the vendor's release notes.

Rotate the cookie signing key. Then invalidate existing sessions. If you cannot establish when you patched relative to when scanning started, assume the key is gone.

What the attacks look like

Horizon3.ai picked up the exploitation on its honeypots. The observed activity is unglamorous: reverse shells, and Base64-encoded commands enumerating running processes — reconnaissance by an operator working out what they have landed on.

Evidence lands in /var/log/switchvox/db-quirks.log on systems with SSH enabled. One source address, 176.65.148[.]184, is already flagged publicly for port scanning, brute-forcing and exploitation.

Roughly 4,000 Switchvox instances are exposed to the internet, predominantly in the United States. Horizon3's own read is that most internet-exposed instances "will be or have already been targeted" — which is a projection, not a measurement, and worth labelling as one.

Twelve flaws, one vendor, one April

The disclosure history matters here more than the CVE does.

Horizon3.ai reported this vulnerability to Sangoma in April 2026 — alongside eleven others. SRA Labs independently found the same bug in May, which tells you it was not buried deep.

And Sangoma products are not new to this. Checking the CISA KEV catalogue directly: three Sangoma FreePBX flaws are already listed as known-exploited — CVE-2025-57819 added 29 August 2025, then CVE-2025-64328 and CVE-2019-19006 both added 3 February 2026. One of those is a 2019 CVE.

When this was written, CVE-2026-9586 was not in KEV as of the 1 September 2026 catalogue, despite confirmed exploitation — and we said that if you use KEV as your prioritisation input, this is the case where it will be late.

Update, 2 September 2026: CISA added it, with a remediation deadline of 5 September. Three days. The gap was 48 hours wide, and it is closed.

What to do

  • Patch to 8.4.0.2 or later. It shipped in July.
  • Rotate the cookie signing key and invalidate sessions. This is the step the advisory does not do for you.
  • Grep /var/log/switchvox/db-quirks.log and check for connections to the flagged address.
  • Take it off the internet. A phone system's management interface has no business being publicly reachable, and 4,000 of them are.
  • Audit administrator accounts created or modified since mid-July.

What is not established

  • How many of the 4,000 are compromised. Exposure is measured; compromise is not.
  • Whether the observed activity is one actor or several. One source address is flagged; that is not the same as one operator.
  • Whether the other eleven Horizon3 findings are fixed, or which of them made it into 8.4.0.2.
  • Whether key theft has occurred outside the research setting. SRA demonstrated it. Nobody has published evidence of it happening in a real intrusion.