Hackers Are Breaking Into Switchvox Phone Systems Through a Critical Flaw

Key points

• Attackers are actively exploiting CVE-2026-9586, a critical flaw in Sangoma Switchvox rated 9.3 out of 10 for severity.
• The bug lets anyone on the internet run commands on a vulnerable phone server, no login required.
• Only Switchvox SMB Edition 8.3 (build 104997) is confirmed affected in public reporting so far.
• Switchvox is a business phone system, so a break-in can expose call recordings, voicemail, and internal directories.
• Administrators should assume any exposed Switchvox box is a target and pull it off the public internet until patched.

Criminals are breaking into business phone systems made by Sangoma, and they do not need a password to do it.

The target is Switchvox, a phone platform used by small and mid-sized companies to run their office calls, voicemail, and call centres over the internet. If you have ever heard the phrase "VoIP", short for Voice over Internet Protocol, that is what Switchvox does: it turns phone calls into internet traffic.

The flaw is tracked as CVE-2026-9586 and carries a severity score of 9.3 out of 10. That is about as bad as these ratings get.

What can the attackers actually do?

They can take over the phone server from anywhere on the internet, without logging in. Once inside, they can read call data, pivot to other machines on the office network, or install a back door for later.

The technical name for the weakness is an unauthenticated SQL injection. In plain terms, the login page (and other web pages on the device) accepts input from visitors and passes it straight into the database that runs the system. A carefully crafted request tricks the database into running the attacker's commands instead of just answering a question. From there, the attackers escalate to running code as the phone system itself, which is the level of access an administrator would normally have.

According to reporting first published by The Hacker News, attackers are using the bug to drop "reverse shells", small programs that phone home to the attacker and let them type commands on the victim's server as if they were sitting in front of it.

Which systems are affected?

Public reporting points at Switchvox SMB Edition 8.3, build 104997. Sangoma customers on other builds should still treat their boxes as suspect until the vendor confirms otherwise, because SQL injection bugs of this kind rarely live in one version alone.

Would multi-factor authentication have helped?

Honestly, no. Multi-factor authentication protects the login door. This attack walks past the door entirely by abusing a bug in how the web application talks to its database. That distinction matters: MFA is about proving who you are (authentication), and it cannot help when the flaw sits before any identity check runs at all.

What would have helped is keeping the Switchvox admin interface off the public internet, behind a VPN or an allow-list of office IP addresses. Most small businesses running these boxes never needed the world to reach the management page.

What should administrators do now?

Get the admin interface off the open internet today. Check Sangoma's advisories for a patched build and apply it as soon as one is available. Then look through logs for odd POST requests to login and API endpoints, unusual outbound connections from the phone server, and any new user accounts you did not create.

If the box has been reachable from the internet for any length of time, treat it as potentially already broken into. Rebuilding from a clean image is safer than trying to clean up a reverse shell you may not fully understand.

Businesses that outsource their phone system to a managed provider should ask that provider, in writing, whether their Switchvox estate is exposed and patched.