Sangoma Switchvox CVE-2026-9586 SQL Injection Under Active Exploitation

Horizon3 disclosed active exploitation of the CVSS 9.3 flaw on Tuesday, providing IoCs that match observed traffic patterns. CISA added the vulnerability to its KEV catalog the next day alongside Starlette request smuggling and Kestra command injection issues, mandating federal patches within three days per BOD 26-04. The defect sits in an XML-processing endpoint that concatenates user input directly into queries without parameterization, enabling arbitrary database operations and shell access.

Procurement records show Switchvox deployments in multiple critical infrastructure operators handling call routing and PBX management. Horizon3 honeypot data and NIST advisory details reveal the same unauthenticated vector previously seen in other telephony platforms, indicating a recurring pattern where VoIP management interfaces receive insufficient input validation. Official statements emphasize patch urgency but omit independent confirmation of post-exploitation lateral movement observed in similar incidents.

The addition to KEV alongside LiteLLM and SonicWall flaws points to coordinated scanning campaigns targeting exposed management planes rather than isolated targeting. Organizations relying on these systems face risks of call interception and credential harvesting that extend beyond the reported RCE. Evidence trails from contract awards and incident reports suggest underreported persistence in enterprise telephony stacks.

CISA requires remediation within three days for federal systems; private operators should prioritize endpoint isolation and query log review using the published IoCs. Continued monitoring will determine if exploitation scales to mass compromise or remains limited to reconnaissance.