Attackers are actively exploiting a critical flaw in Sangoma Switchvox, the enterprise Voice over Internet Protocol management platform used to configure and monitor business phone systems, according to BleepingComputer. The vulnerability, tracked as CVE-2026-9586, is an unauthenticated SQL injection issue that can lead to remote code execution. BleepingComputer reports that security researchers at Horizon3 identified the flaw as the most serious of 12 vulnerabilities they found in Switchvox and reported to Sangoma on April 10. Sangoma fixed the issues in Switchvox version 8.4.0.2, released on July 14, according to the report. That means the main operational question is now patch uptake among internet-exposed deployments. The bug sits in Switchvox’s /pa HTTP endpoint, BleepingComputer says, citing Horizon3’s analysis. The endpoint parses XML messages containing key-value pairs for events such as incoming or outgoing call notifications. Horizon3 found that the system extracts the PhoneIP field and places its value directly into an unparameterized SQL query, creating the injection path. Horizon3 researchers demonstrated that a crafted XML request could be used remotely to execute operating-system commands, BleepingComputer reports. On August 30, Horizon3 honeypots then observed active exploitation against multiple systems in rapid succession from a single source IP address: 176.65.148.184. The attacker was attempting to establish a reverse shell. In the observed attempts, the attacker executed an initial payload, gathered information about the top processes running on the Switchvox system, and sent that data to a remote server in base64-encoded form, according to the report. Horizon3 said it had not seen active exploitation of the other 11 Switchvox flaws it previously disclosed. The exposure may be material for organizations that leave Switchvox reachable from the public internet. BleepingComputer reports that Horizon3’s Shodan check showed approximately 4,000 internet-exposed devices, most located in the United States. Horizon3 warned that, based on the rapid sequence of honeypot hits from the same source IP, most exposed instances either have already been targeted or likely will be soon. The recommended action is straightforward: administrators should upgrade to Switchvox 8.4.0.2 or later and look for signs that their systems were already probed or compromised. BleepingComputer lists suspicious statements in /var/log/switchvox/db-quirks.log and network connections to 176.65.148.184, particularly on port 39323, as indicators to review. Who benefits: Defenders benefit from the specific version, endpoint, log path, IP address and port called out in the reporting. Organizations already on Switchvox 8.4.0.2 or later are in a stronger position, assuming they also review for prior targeting. Who's exposed: Organizations running internet-exposed Switchvox systems that have not upgraded to version 8.4.0.2 or later are the clearest exposure group. Systems that were exposed before patching may still warrant log and network review.