Hackers Are Breaking Into Switchvox Phone Systems Through a Critical Flaw
A severe bug in Sangoma's business phone platform lets attackers run code on servers without a password. Exploitation is already happening.
Key points
- Attackers are actively exploiting CVE-2026-9586, a critical flaw in Sangoma Switchvox rated 9.3 out of 10 for severity.
- The bug lets anyone on the internet run commands on a vulnerable phone server, no login required.
- Only Switchvox SMB Edition 8.3 (build 104997) is confirmed affected in public reporting so far.
- Switchvox is a business phone system, so a break-in can expose call recordings and internal directories.
- Administrators should pull any exposed Switchvox box off the public internet until a patch is confirmed.
Criminals are breaking into business phone systems made by Sangoma, and they don't need a password.
The target is Switchvox, a VoIP (Voice over Internet Protocol) platform used by small and mid-sized companies to run office calls and voicemail. The flaw is tracked as CVE-2026-9586 and carries a CVSS severity score of 9.3 out of 10. That's about as bad as these ratings get.
What can the attackers actually do?
They can take over the phone server from anywhere on the internet, without logging in. Once inside, they can read call data, pivot to other machines on the office network, or install a back door for later.
The weakness is an unauthenticated SQL injection. The login page accepts visitor input and passes it straight into the database that runs the system. A crafted request tricks the database into running the attacker's commands instead of answering a question, and from there the attacker escalates to running code at administrator level. According to reporting first published by The Hacker News, attackers are using the bug to drop reverse shells: small programs that phone home to the attacker and let them issue commands on the victim's server remotely.
This pattern isn't new. We reported on 26 August that a public proof-of-concept against SharePoint turned into live attacks within a day, and the same tight gap between disclosure and exploitation is playing out here.
Which systems are affected?
Public reporting points at Switchvox SMB Edition 8.3, build 104997. Sangoma customers on other builds should treat their boxes as suspect until the vendor confirms otherwise, because SQL injection bugs of this kind rarely live in one version alone.
| Detail | Value |
|---|---|
| CVE | CVE-2026-9586 |
| CVSS score | 9.3 (critical) |
| Product | Sangoma Switchvox SMB Edition |
| Affected build | 8.3 (104997) |
| Access needed | None (unauthenticated) |
| Impact | Remote code execution |
Should you worry about multi-factor authentication?
Honestly, no. MFA protects the login door. This attack walks past the door entirely by abusing a bug in how the web application talks to its database. MFA is about proving who you are, and it can't help when the flaw sits before any identity check runs at all.
What would've helped is keeping the Switchvox admin interface off the public internet, behind a VPN or an IP allow-list. Most small businesses running these boxes never needed the world to reach the management page.
What should administrators do now?
Get the admin interface off the open internet today. Check Sangoma's advisories for a patched build and apply it as soon as one is available. Then comb through logs for odd POST requests to login and API endpoints, plus any new user accounts you didn't create.
If the box has been reachable from the internet for any length of time, treat it as potentially already compromised. Rebuilding from a clean image is safer than trying to unpick a reverse shell you may not fully understand. Businesses that outsource their phone system to a managed provider should ask that provider, in writing, whether their Switchvox estate is exposed and patched.
