Business phone systems rarely make headlines, which is exactly why they make attractive targets. A newly disclosed vulnerability in Sangoma’s Switchvox unified communications platform is now being actively probed by attackers, according to researchers who spotted exploitation attempts against honeypots designed to mimic real-world VoIP deployments.

An Endpoint Meant for Phones, Not Hackers

The flaw, tracked as CVE-2026-9586, carries a near-maximum CVSS score of 9.3 and lives inside the “/pa” endpoint that Switchvox uses to process XML configuration messages sent by IP phones on a network. Under normal circumstances, that endpoint reads a value identifying the phone’s IP address and uses it to look up device settings in the system’s PostgreSQL database.

The problem is how that lookup happens. Instead of properly sanitizing or parameterizing the incoming value, the code inserts it directly into a database query. Because the query then runs with elevated PostgreSQL permissions, an attacker who crafts a malicious XML request doesn’t just manipulate the database — they can push the system into executing operating system commands, all without ever supplying a username or password.

From Theoretical Risk to Live Exploitation

What turns this from a paper vulnerability into an urgent problem is evidence of real exploitation. Researchers tracking honeypot traffic observed attempts originating from a single IP address late last month, with intruders trying to establish reverse shells using Netcat and base64-encoded commands. The follow-up activity looked like reconnaissance — attackers checking which processes were running on compromised systems, a typical first step before deploying further payloads or pivoting deeper into a network.

Because Switchvox often sits at the center of an organization’s telephony and, in many deployments, touches the broader internal network, a successful compromise could hand an attacker far more than call logs. Reconnaissance of running processes suggests the intrusions observed so far were still in an early, information-gathering stage — but that stage tends not to last long once a working exploit is circulating.

Thousands of Systems Still Exposed

Internet scanning data cited by researchers puts the number of exposed Switchvox devices at roughly 4,000, with the majority located in the United States. That figure only counts systems reachable directly from the internet; it doesn’t account for internal deployments that could be reached by an attacker who has already gained a foothold elsewhere on a network.

A Patch Has Existed Since July

The vulnerability was reported to Sangoma back in April as part of a larger batch of twelve issues disclosed by researchers at Horizon3.ai, working alongside Defused Cyber. Sangoma addressed the flaw with the release of Switchvox version 8.4.0.2 on July 14, meaning a fix has been publicly available for close to two months before the exploitation attempts were observed. Systems still running version 8.3, build 104997, or earlier remain vulnerable.

The gap between patch availability and active scanning is a familiar pattern in enterprise software: administrators of appliance-style systems like PBXs and VoIP platforms often treat them as “set and forget” infrastructure, checking in only when something breaks. That habit is precisely what attackers are counting on.

What Administrators Should Do

Security teams running Switchvox, or managing it on behalf of clients, should treat this as an immediate priority rather than routine maintenance. Recommended steps include:

• Upgrade to Switchvox 8.4.0.2 or later without delay.
• Review PostgreSQL and application logs for unusual or malformed queries hitting the /pa endpoint.
• Check outbound connection logs for traffic to the attacker IP address identified by researchers, and treat any match as a likely compromise requiring incident response.
• Where upgrading isn’t immediately possible, restrict access to the /pa endpoint so it’s reachable only from trusted internal phone-network segments, not the open internet.
• Audit for unexpected reverse shell processes or newly created scheduled tasks on the Switchvox host.

Unauthenticated, remotely exploitable flaws in internet-facing communications infrastructure tend to attract sustained attacker interest once details circulate, and Switchvox’s footprint in small and mid-sized businesses makes it a reasonably efficient target for opportunistic scanning campaigns. Given that active probing has already been confirmed, organizations still running unpatched versions should assume they are on borrowed time.