{"vulnerability": "cve-2026-9586", "sightings": [{"uuid": "832562ab-0875-4139-b215-c91aba58b1cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqueaetgtc24", "content": "CVE-2026-9586 - switchvox smb edition\nThe Sangoma Switchvox SMB Edition 8.3 is vulnerable to a SQL injection attack that allows an attacker to execute arbitrary code on the system. This means an attacker could\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#sangoma #CVE #infosec", "creation_timestamp": "2026-07-17T18:16:04.638074Z"}, {"uuid": "ee2f80a4-35a5-49d6-9cee-9c78b1861965", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqug2pd24u2g", "content": "CVE-2026-9586 - Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB\nCVE ID : CVE-2026-9586\n \n Published : July 17, 2026, 5:17 p.m. | 24\u00a0minutes ago\n \n Description : An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Editi...", "creation_timestamp": "2026-07-17T18:48:41.466260Z"}, {"uuid": "4f895f2d-b7fd-480e-a8aa-81064b5b8655", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/r-netsec-bot.bsky.social/post/3muhh3idkxj2c", "content": "Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586", "creation_timestamp": "2026-09-01T12:43:12.440184Z"}, {"uuid": "6624591c-0f9f-4114-83f7-22f65be88613", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/r-netsec.bsky.social/post/3muhkaab7xu2l", "content": "Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586", "creation_timestamp": "2026-09-01T13:39:31.921076Z"}, {"uuid": "f662fd56-80cb-40c8-83e6-98bbea5ed2d6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3muhoqt5bx22i", "content": "CVE-2026-9586, a critical Sangoma Switchvox vulnerability, is exploited in the wild, giving unauthenticated attackers SQL injection and remote code execution.\n\n#Sangoma #Switchvox #CVE20269586 #RCE #SQLInjection #VoIP #InfoSec #ExploitedInTheWild", "creation_timestamp": "2026-09-01T15:00:24.046360Z"}, {"uuid": "774e34c5-345e-40fb-a094-6733374557f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-9586.yaml", "content": "", "creation_timestamp": "2026-09-02T03:00:05.823799Z"}, {"uuid": "144b3da6-e734-4e05-807b-22869a688078", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://t.me/thehackernews/9940", "content": "\ud83d\uded1 Attackers are exploiting Switchvox without credentials to deploy reverse shells.\n\nCVE-2026-9586 is a critical SQL injection in the /pa endpoint. About 4,000 instances are exposed online, and Sangoma has released a patch.\n\nInside the exploit: https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html", "creation_timestamp": "2026-09-02T08:00:04.806518Z"}, {"uuid": "1093e722-8a4c-46c0-88cb-2f533551ce6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mujhurdyan2w", "content": "CVE-2026-9586 enables unauthenticated remote code execution in Sangoma Switchvox SMB Edition 8.3 via SQL injection, patched in 8.4.0.2.\n", "creation_timestamp": "2026-09-02T08:02:40.007567Z"}, {"uuid": "74c08253-e8f8-4ab5-9271-61d9bcbcc253", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mujkonlgde2y", "content": "\ud83e\udd16 CVE-2026-9586 (CVSS 9.3): critical unauthenticated SQL injection in Sangoma Switchvox SMB Edition 8.3, exploited in the wild to deploy reverse shells without credentials.\nhttps://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html", "creation_timestamp": "2026-09-02T08:52:55.112621Z"}, {"uuid": "86487803-5869-4d7b-84ff-693f5517729c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html", "content": "Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution.\n\nThe vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as", "creation_timestamp": "2026-09-02T10:00:45.831898Z"}, {"uuid": "7aaf3136-0cc4-4313-8bf8-96079d6e7fb7", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/6d9fe916-40f9-4dd2-8f76-1ca18edec11b", "content": "", "creation_timestamp": "2026-09-02T11:00:28.732722Z"}, {"uuid": "c903a542-0fb3-460b-a8ba-ba781dc773b0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "Telegram/CwRikFTAT7Ys74ZbyH3SPKa9CHrArdWdMqLwV8aHu5lhSw", "content": "", "creation_timestamp": "2026-09-02T12:00:04.964838Z"}, {"uuid": "762e5610-24d4-47ed-b2a3-bdf12f4a5e6b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mujwt2gtyy22", "content": "\ud83d\udd34 EXPLOITED\n\nSangoma Switchvox has a critical unauthenticated flaw (CVE-2026-9586, CVSS 9.3) that lets a stranger run code on the phone system.\n\nPatched in July, mass-exploited since Aug 30. Around 4,000 consoles are exposed.\n\nFix: update to 8.4.0.2 and hunt the logs.", "creation_timestamp": "2026-09-02T12:30:08.110683Z"}, {"uuid": "a5c69043-e5fa-4a91-9788-74889663c150", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/helpnetsecurity.com/post/3mujxxqwbxc25", "content": "Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)\n\n\ud83d\udd17 Read more: www.helpnetsecurity.com/2026/09/02/e...\n\n #vulnerability #exploit #Cybersecurity \n@horizon3ai.bsky.social", "creation_timestamp": "2026-09-02T12:50:42.925502Z"}, {"uuid": "be72e017-c243-4a2c-87e5-0da7ed4653f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mujytuga5h2x", "content": "Sangoma Switchvox\u306e\u8106\u5f31\u6027(CVE-2026-9586)\u3001\u60aa\u7528\u304c\u9032\u884c\u4e2d\n\n\u8105\u5a01\u30a2\u30af\u30bf\u30fc\u304c\u3001\u6700\u8fd1\u30d1\u30c3\u30c1\u304c\u63d0\u4f9b\u3055\u308c\u305fSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027(CVE-2026-9586)\u3092\u60aa\u7528\u3057\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u306b\u516c\u958b\u3055\u308c\u305fSangoma Switchvox\u306e\u30a4\u30f3\u30b9\u30bf\u30f3\u30b9\u3092\u7a4d\u6975\u7684\u306b\u72d9\u3063\u3066\u3044\u307e\u3059\u3002\u540c\u88fd\u54c1\u3092\u904b\u7528\u3057\u3066\u3044\u308b\u7d44\u7e54\u306f\u3001\u76f4\u3061\u306b\u4fb5\u5bb3\u306e\u5146\u5019\u304c\u306a\u3044\u304b\u78ba\u8a8d\u3059\u308b\u5fc5\u8981\u304c\u3042\u308a\u307e\u3059\u3002 CVE-2026...", "creation_timestamp": "2026-09-02T13:06:22.366587Z"}, {"uuid": "2dd06e96-b24b-41ff-80ab-988162a01f3b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/hapsis.bsky.social/post/3muk3sjxiw22a", "content": "Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)\n\nwww.helpnetsecurity.com/2026/09/02/e...\n\n#Kyberturvallisuus #ThreatIntel #Haavoittuvuus", "creation_timestamp": "2026-09-02T13:59:20.910490Z"}, {"uuid": "b739977b-e246-4631-ba2c-c7f6ea290b20", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "Telegram/s3zjyT-FT6tCC8Ykb-K7GeZvS_lBBM3ljM38r7xtE1exsPM", "content": "", "creation_timestamp": "2026-09-02T16:00:04.558975Z"}, {"uuid": "3c13f1fb-5198-4f38-bc51-aaf279378a24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/packetstorm.bsky.social/post/3mukhkahwyk24", "content": "Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586 https://packetstorm.news/news/view/43034 #news", "creation_timestamp": "2026-09-02T17:29:25.554381Z"}, {"uuid": "c24f4cfb-6745-413d-9842-6ee8639da714", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukhlazpn22q", "content": "\ud83d\uded1 CVE-2026-9586\nSangoma Switchvox\nCVSS 9.3 / EPSS 1% / KEV: No\nTL;DR: An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 \u2026\nhttps://cvesentinel.com/report/CVE-2026-9586?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T17:29:59.838392Z"}, {"uuid": "c3ed0f53-414e-490b-b7e2-3ba1fcf3e3bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/csirts.com/post/3mukj5iiwuj2y", "content": "\ud83d\udea8 Added to CISA KEV \u2014 actively exploited:\nCVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability\n\nhttps://www.csirts.com/cve/CVE-2026-9586", "creation_timestamp": "2026-09-02T17:58:05.876228Z"}, {"uuid": "ca477e69-cfe9-45fd-8c46-5aadfbc07d01", "vulnerability_lookup_origin": "405284c2-e461-4670-8979-7fd2c9755a60", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/b4b52e5f-1b26-464a-ae40-bf8709145368", "content": "", "creation_timestamp": "2026-09-02T18:00:03.912500Z"}, {"uuid": "3cd8d5e1-d0a2-4612-9d6b-1c70b39f2b66", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mukjszbeao2i", "content": "\ud83d\uded1 CVE-2026-9586\nSangoma Switchvox\nCVSS 9.3 / EPSS 1% / KEV \u2705\nTL;DR: An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (1\u2026\nhttps://cvesentinel.com/report/CVE-2026-9586?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "creation_timestamp": "2026-09-02T18:10:08.716875Z"}, {"uuid": "5901b2cf-b339-4727-8c6c-631a0d87ced1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://infosec.exchange/users/AAKL/statuses/117202988713449046", "content": "Looks like CISA's on a roll. Seven vulnerabilities have been added to the catalogue.\n- CVE-2026-83549: SonicWall SMA1000 Appliances OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83549\n- CVE-2026-83548: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-83548\n- CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-9586\n- CVE-2026-82329: JFrog Artifactory Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-82329\n- CVE-2026-49869: Kestra OSS OS Command Injection Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-49869\n- CVE-2026-48710: Kludex Starlette HTTP Request/Response Smuggling Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-48710\n- CVE-2026-59822: BerriAI LiteLLM Improper Authentication Vulnerability https://www.cve.org/CVERecord?id=CVE-2026-59822 #CISA #infosec #vulnerability", "creation_timestamp": "2026-09-02T19:01:24.506337Z"}, {"uuid": "84cb7a49-bfa8-4543-a16a-0d26be5236d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/bleepingcomputer.com/post/3muktdv5tvf2v", "content": "Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution.", "creation_timestamp": "2026-09-02T21:00:37.530579Z"}, {"uuid": "c0a2b22d-40bc-43ed-b751-8ff0c425ef0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3muktnevqtx2y", "content": "\ud83e\udd16 CVE-2026-9586: unauthenticated SQL injection in Sangoma Switchvox VoIP PBX actively exploited, leading to RCE and reverse shells. Patch exposed instances.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/", "creation_timestamp": "2026-09-02T21:05:56.111791Z"}, {"uuid": "085ab184-ff9a-4d6e-a240-a168bd4d9d29", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://t.me/BleepingComputer/25468", "content": "\u200aHackers exploit Sangoma Switchvox flaw to deploy reverse shells\n\nAttackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/", "creation_timestamp": "2026-09-02T22:00:05.043148Z"}, {"uuid": "1f0b0d34-30b0-49c6-8967-335d05e835b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mukyeezfwp23", "content": "Hackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox, to trigger remote code execution via the /pa endpoint and deploy reverse shells. #Switchvox #Sangoma #Horizon3", "creation_timestamp": "2026-09-02T22:30:23.372144Z"}, {"uuid": "65c08fb4-1a47-4632-be90-b5a8f8860d5f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://t.me/BleepingComputer/25468", "content": "\u200aHackers exploit Sangoma Switchvox flaw to deploy reverse shells\n\nAttackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]\n\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/", "creation_timestamp": "2026-09-03T00:00:37.115340Z"}, {"uuid": "76e1fd0f-e015-4fcc-9f07-90b2eaf6a86e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "published-proof-of-concept", "source": "Telegram/s3zjyT-FT6tCC8Ykb-K7GeZvS_lBBM3ljM38r7xtE1exsPM", "content": "", "creation_timestamp": "2026-09-03T00:00:41.368259Z"}, {"uuid": "05ebff31-80b1-4585-b0f3-1b56b4459454", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "published-proof-of-concept", "source": "Telegram/CwRikFTAT7Ys74ZbyH3SPKa9CHrArdWdMqLwV8aHu5lhSw", "content": "", "creation_timestamp": "2026-09-03T00:00:47.260390Z"}, {"uuid": "7b5a2558-f8fb-498b-9009-718b6fec45f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://t.me/thehackernews/9940", "content": "\ud83d\uded1 Attackers are exploiting Switchvox without credentials to deploy reverse shells.\n\nCVE-2026-9586 is a critical SQL injection in the /pa endpoint. About 4,000 instances are exposed online, and Sangoma has released a patch.\n\nInside the exploit: https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html", "creation_timestamp": "2026-09-03T00:00:51.275648Z"}, {"uuid": "e7bb80f3-d170-44de-9521-3c7fcf74c143", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://thehackernews.com/2026/09/attackers-exploit-critical-switchvox.html", "content": "Threat actors are exploiting a severe security vulnerability in Sangoma Switchvox, an enterprise VoIP platform, that could allow unauthenticated remote code execution.\n\nThe vulnerability in question is CVE-2026-9586 (CVSS score: 9.3), a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997) that can allow attackers to remotely execute arbitrary code as", "creation_timestamp": "2026-09-03T01:00:32.277936Z"}, {"uuid": "d6608584-3303-4635-9282-709ca6228572", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3muljxnp7fg2f", "content": "Active exploitation of CVE-2026-9586 in Sangoma Switchvox is dropping reverse shells and staging malware on internet-exposed systems. Patch 8.4.0.2 and review indicators of compromise. #Switchvox #CVE20269586 #Asterisk", "creation_timestamp": "2026-09-03T03:45:23.865018Z"}, {"uuid": "acca1e0c-b8fc-4f7e-9513-7ac368c1a875", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9586", "type": "seen", "source": "https://bsky.app/profile/ahmandonk.bsky.social/post/3mulk4s6uqe2f", "content": "\ud83d\udcf0 Hacker Eksploit Celah Sangoma Switchvox untuk Menyebarkan Reverse Shell\n\n\ud83d\udc49 Baca artikel lengkap di sini: https://ahmandonk.com/2026/09/03/celah-sangoma-switchvox-cve-2026-9586/\n\n#cybersecurity #keamananSiber #rce #sangoma #switchvox #teknologi #voip #vulnerability", "creation_timestamp": "2026-09-03T03:48:15.525183Z"}, {"uuid": "68c08e30-8d53-436b-800c-fc9d46d61903", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mulovhdjtf2r", "content": "\ud83e\udd16 CVE-2026-9586: unauthenticated SQLi in Sangoma Switchvox VoIP platform, actively exploited to deploy reverse shells (RCE). Patch now.\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/", "creation_timestamp": "2026-09-03T05:13:37.814806Z"}, {"uuid": "c0f6c79d-76db-4828-9541-b87417604650", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3multa4vriq2j", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-9586: \u26a0\ufe0f CVE-2026-9586: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 1.1%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-9586-an-unauthenticated-sql-injection-vulnerability-exists", "creation_timestamp": "2026-09-03T06:31:10.785228Z"}, {"uuid": "540444fd-2a4e-4ecc-99b5-502ffd4487af", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mumd3acb5v25", "content": "Threat actors are exploiting CVE-2026-9586, a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (CVSS score: 9.3), allowing remote code execution as the PostgreSQL superuser. Sangoma released patches on July 14, 2026.", "creation_timestamp": "2026-09-03T11:14:47.712394Z"}, {"uuid": "9fd3b7be-1b02-4847-9cb1-d55f3d86f695", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-9586.yaml", "content": "", "creation_timestamp": "2026-09-03T12:00:04.876496Z"}, {"uuid": "32471b9f-7038-42c9-b723-845dc306cb91", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mumpugiusc25", "content": "Exploitation of Sangoma Switchvox flaw is underway (CVE-2026-9586)\n\nA threat actor is actively targeting internet-exposed Sangoma Switchvox instance through a recently patched SQL injection flaw (CVE-2026-9586), and organizations running them should check for signs of compromise i\u2026\n#hackernews #news", "creation_timestamp": "2026-09-03T15:03:37.957844Z"}, {"uuid": "56291840-a88c-43ee-9d4f-bff46943f49f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/royans.bsky.social/post/3mumzcscqhx27", "content": "Critical Unauthenticated SQL Injection in Sangoma Switchvox Enables RCE\n\nhttps://xploitzone.com/cve-2026-9586-sangoma-switchvox-exploit\nhttps://flagthis.com/tldr/6921\n\n##SQLInjection ##RCE ##VoIP ##CVE-2026-9586 ##Sangoma", "creation_timestamp": "2026-09-03T17:52:44.438260Z"}, {"uuid": "1dddab96-6a21-4063-84f1-999a29698449", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/hacker.at.thenote.app/post/3mung62v5tc25", "content": "Hackers exploit Sangoma Switchvox flaw to deploy reverse shells\n\nAttackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]\n#hackernews #news", "creation_timestamp": "2026-09-03T21:42:43.084578Z"}, {"uuid": "7ef39467-3f9b-4c50-ba0a-15b41610324b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-9586.yaml", "content": "", "creation_timestamp": "2026-09-04T00:00:03.414562Z"}, {"uuid": "0ce1111f-c18c-454e-af45-2ffc252752ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-9586", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3muntb7qfuj23", "content": "\ud83d\udccc Active Exploitation of Sangoma Switchvox CVE-2026-9586 Observed https://www.cyberhub.blog/article/31629-active-exploitation-of-sangoma-switchvox-cve-2026-9586-observed", "creation_timestamp": "2026-09-04T01:37:07.511168Z"}, {"uuid": "07ae742c-bb29-4006-9b05-98e94fe3d328", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/vulnsea.com/post/3muo4kqlgue2y", "content": "\ud83c\udf11 HADAL \u00b7 actively exploited critical\nCVE-2026-9586: An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).\u00a0The /pa endpoint processes\u2026\nCVSS 9.8 \u00b7 EPSS 11.8% \u00b7 CISA KEV\nhttps://beta.vulnsea.com/cve/CVE-2026-9586\n\n#CVE #infosec #cybersecurity #threatintel", "creation_timestamp": "2026-09-04T04:23:30.153749Z"}, {"uuid": "874ecc3f-1c8f-4bae-9305-ddcbdf76abc2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/", "content": "Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]", "creation_timestamp": "2026-09-04T10:00:44.524323Z"}, {"uuid": "2ae06492-3d4f-4d30-882f-5130ab9d64a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/infosecbriefly.bsky.social/post/3mup3g6f6xz2y", "content": "CVE-2026-9586 in Sangoma Switchvox enables unauthenticated remote SQL injection leading to arbitrary code execution via crafted XML requests.\n", "creation_timestamp": "2026-09-04T13:35:43.992417Z"}, {"uuid": "6c4800d8-6cfd-4b49-a419-34b02e178ed9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/devopsbriefly.bsky.social/post/3mup3gafasq2l", "content": "CVE-2026-9586 in Sangoma Switchvox enables unauthenticated remote SQL injection leading to arbitrary code execution via crafted XML requests.\n", "creation_timestamp": "2026-09-04T13:35:47.975873Z"}, {"uuid": "8aec9fe0-af96-46a9-8f82-c65cea577eaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/privpros.bsky.social/post/3mup3iwnkoz2j", "content": "CVE-2026-9586 in Sangoma Switchvox enables unauthenticated remote SQL injection leading to arbitrary code execution via crafted XML requests.\n", "creation_timestamp": "2026-09-04T13:37:15.972572Z"}, {"uuid": "520435c3-ad77-41eb-b88b-c82bcbb93663", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mup5o4gftc2c", "content": "Switchvox CVE-2026-9586 lets an unauthenticated attacker reach a root shell via SQL injection. Active exploitation seen; patch to 8.4.0.2.\n\n#Switchvox #CVE20269586 #RCE #SQLInjection #Sangoma #VoIP #InfoSec", "creation_timestamp": "2026-09-04T14:15:57.068480Z"}, {"uuid": "86a71597-af51-4040-9104-3cafb5c9c9de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/blackhatnews.tokyo/post/3mup6ef7mu72i", "content": "Switchvox CVE-2026-9586:\u672a\u8a8d\u8a3c\u306eSQL\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u304cRCE\u306b\u767a\u5c55\u3001\u5b9f\u969b\u306e\u653b\u6483\u3067\u60aa\u7528\u4e2d\n\n\u4f01\u696d\u5411\u3051\u96fb\u8a71\u4ea4\u63db\u6a5fSangoma Switchvox\u3067\u306f\u3001\u7279\u5225\u306b\u7d30\u5de5\u3055\u308c\u305fXML\u30ea\u30af\u30a8\u30b9\u30c8\u30921\u4ef6\u9001\u4fe1\u3059\u308b\u3060\u3051\u3067\u3001\u30a4\u30f3\u30bf\u30fc\u30cd\u30c3\u30c8\u4e0a\u306e\u898b\u77e5\u3089\u306c\u7b2c\u4e09\u8005\u304c\u30b5\u30fc\u30d0\u30fc\u306e\u30b3\u30de\u30f3\u30c9\u30b7\u30a7\u30eb\u306b\u5230\u9054\u3067\u304d\u3066\u3057\u307e\u3044\u307e\u3059\u3002\u3053\u306e\u91cd\u5927\u306a\u8106\u5f31\u6027\u306f\u3059\u3067\u306b\u7a3c\u50cd\u4e2d\u306e\u30b7\u30b9\u30c6\u30e0\u306b\u5bfe\u3057\u3066\u63a2\u7d22\u884c\u70ba\u304c\u78ba\u8a8d\u3055\u308c\u3066\u304a\u308a\u3001\u653b\u6483\u306f\u7814\u7a76\u8005\u304c\u8a2d\u7f6e\u3057\u305f\u30c7\u30b3\u30a4\u306e...", "creation_timestamp": "2026-09-04T14:28:24.573488Z"}, {"uuid": "984ef252-438f-4b8d-b723-0537eeb01935", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/cyberveille-ch.bsky.social/post/3mupbsoyytr2r", "content": "\ud83d\udce2 Exploitation active de CVE-2026-9586 dans Sangoma Switchvox pour d\u00e9ployer des reverse shells\n\nBleepingComputer, publi\u00e9 le 2 septembre 2026. Des chercheurs de Horizon3 ont observ\u00e9 l'exploitation active de CVE-2026-9586\u2026\n\n\ud83d\udfe2 v\u00e9rification factuelle haute\n#ReverseShell #SangomaSwitchvox #Cyberveille", "creation_timestamp": "2026-09-04T15:30:09.934834Z"}, {"uuid": "7b4f08a0-a553-4518-a9cf-8a8971b1edc0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/", "content": "Tracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution.\n\nThe post Sangoma Switchvox Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.", "creation_timestamp": "2026-09-04T16:00:41.415809Z"}, {"uuid": "df5288e7-3bff-4d8c-b702-ec61b6738cd8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mupi24b3vi2i", "content": "Same story, different day, as Sangoma Switchvox systems find themselves actively hammered in the wild by remote opportunists. Anyone operating these voice appliances is directly affected by CVE-2026-9586, which graciously hands attackers unauthenticated SQL injection and remote c...\n\nRead full story", "creation_timestamp": "2026-09-04T17:21:37.219947Z"}, {"uuid": "d8ee8fa2-f6c0-442e-a8a4-bc6d0893729e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mupk7jy6ql27", "content": "CISA and Horizon3 confirm active exploitation of CVE-2026-9586, a critical unauthenticated SQL injection in Sangoma Switchvox that can enable remote code execution. #Switchvox #CVE20269586 #CISA", "creation_timestamp": "2026-09-04T18:00:26.637424Z"}, {"uuid": "8654de61-b92d-4b0d-b90b-ac367e088916", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://t.me/pphm_HackerNews/3013", "content": "\ud83d\udd34 Sangoma Switchvox Vulnerabilities Exploited in the Wild\n\nThreat actors have been exploiting a critical-severity vulnerability in the enterprise VoIP telephony management solution Sangoma Switchvox, Horizon3 and CISA warn.\n\nTracked as CVE-2026-9586 (CVSS score of 9.3) and described as an unauthenticated SQL injection issue, the security defect can be exploited remotely for arbitrary code execution.\n\nIt resides in an endpoint that processes XML content, which did not perform sanitization or parameterization when concatenating the user-controlled PhoneIP value into PostgreSQL queries.", "creation_timestamp": "2026-09-04T23:00:03.844177Z"}, {"uuid": "79b3a18a-aca8-4503-a7a1-e3e6eaccb31c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-9586.yaml", "content": "", "creation_timestamp": "2026-09-05T00:00:03.176879Z"}, {"uuid": "e26b1dfa-5c1d-4226-85c3-c979f939f8d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://t.me/information_security_channel/55854", "content": "Sangoma Switchvox Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/\n\nTracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution.\nThe post Sangoma Switchvox Vulnerabilities Exploited in the Wild (https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-05T01:00:05.257832Z"}, {"uuid": "d0c0773f-47c5-42fd-865e-840640479164", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3013", "content": "\ud83d\udd34 Sangoma Switchvox Vulnerabilities Exploited in the Wild\n\nThreat actors have been exploiting a critical-severity vulnerability in the enterprise VoIP telephony management solution Sangoma Switchvox, Horizon3 and CISA warn.\n\nTracked as CVE-2026-9586 (CVSS score of 9.3) and described as an unauthenticated SQL injection issue, the security defect can be exploited remotely for arbitrary code execution.\n\nIt resides in an endpoint that processes XML content, which did not perform sanitization or parameterization when concatenating the user-controlled PhoneIP value into PostgreSQL queries.", "creation_timestamp": "2026-09-05T01:00:08.782384Z"}, {"uuid": "97fb0b30-9b61-4c83-854f-4461720e7b2b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/", "content": "Tracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution.\n\nThe post Sangoma Switchvox Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.", "creation_timestamp": "2026-09-05T01:00:35.510965Z"}, {"uuid": "90d353a0-3a5e-4093-babf-318afc5effaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/", "content": "Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]", "creation_timestamp": "2026-09-05T01:00:34.515037Z"}, {"uuid": "96b785c9-5fa6-4d82-9637-6fdd04f86abc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3muqnuhh7oc2z", "content": "\ud83d\udd34 Sangoma Switchvox PBX under active attack\n\nAttackers are exploiting CVE-2026-9586 (CVSS 9.3) \u2014 an unauthenticated SQL injection that can lead to RCE. Reverse-shell attempts are already being observed\n\nstemshop.top/blog/switchv...\n\n#CVE #CVE20269586 #Sangoma #Switchvox #PBX #RCE #CyberSecurity", "creation_timestamp": "2026-09-05T04:38:41.853100Z"}, {"uuid": "0a5fd239-b043-44e1-9d8c-d814e6f64765", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3muqp6qlxui25", "content": "Daily IT Security Digest \u2014 2026-09-05\n**Sangoma Switchvox PBX Exploited: CVE-2026-9586 (CVSS 9.3)**\n   An unauthenticated SQL injection in Sangoma Switchvox can lead to remote code execution. Reverse-shell attempts are already being observed in the wild, making urgent patching critical for", "creation_timestamp": "2026-09-05T05:02:08.365469Z"}, {"uuid": "b36aa2e7-8a44-470c-ad89-9bb57e0ed565", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3muqwch3wvz2l", "content": "Patch Sangoma Switchvox SMB Edition now \u2014 CVE-2026-9586 (CVSS 9.8) unauthenticated SQLi is under active exploitation, on CISA KEV with a 5 Sept deadline. Update to v8.4.0.2. https://securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild", "creation_timestamp": "2026-09-05T07:09:28.820791Z"}, {"uuid": "59c5f275-64a2-4f45-97e3-b0f02521b744", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3muqxicqjro2r", "content": "Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586 #patchmanagement", "creation_timestamp": "2026-09-05T07:30:39.363500Z"}, {"uuid": "2739a3bf-b301-44e1-8609-79f130e67ee2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://t.me/information_security_channel/55854", "content": "Sangoma Switchvox Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/\n\nTracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution.\nThe post Sangoma Switchvox Vulnerabilities Exploited in the Wild (https://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-09-06T00:01:04.841046Z"}, {"uuid": "059878e9-7c4b-4657-a0f9-f4f4ea9e89ea", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3728a227-1873-4466-9e2b-f17600951034", "content": "", "creation_timestamp": "2026-09-06T01:01:10.959756Z"}, {"uuid": "aecef9a0-7710-4777-8eac-95f9241f54b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/kotosecurity.bsky.social/post/3muvmrkzveb24", "content": "\ud83d\udd0d DETAIL: CVE-2026-83548 (SonicWall) + CVE-2026-83549 (cmd injection) chain confirmed in wild. CVE-2026-9586 (Switchvox SQLi) allows unauth RCE. CVE-2026-82329 (JFrog) lets attackers obtain admin creds via default config. Horizon3 & watchTowr confirm exploitation. #ThreatIntel", "creation_timestamp": "2026-09-07T04:02:17.656967Z"}, {"uuid": "ac888df1-5b82-40a1-9550-a8126d05f25f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://bsky.app/profile/r-blueteamsec.bsky.social/post/3muxugfosbl27", "content": "CVE-2026-9586: Sangoma Switchvox RCE", "creation_timestamp": "2026-09-08T01:24:32.287203Z"}, {"uuid": "888cef4b-53e6-43ca-a739-77ec669f00ae", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://t.me/VulnerabilityNews/44290", "content": "CISA Adds Seven Known Exploited Vulnerabilities to Catalog\n\nCISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. \u00a0\nCVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability\u00a0\nCVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability\u00a0\nCVE-2026-49869 Kestra OSS OS Command Injection Vulnerability\u00a0\nCVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability\u00a0\nCVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability\u00a0\nCVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability\u00a0\nCVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability\u00a0\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\u00a0\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\u00a0\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\u00a0\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-18T12:00:04.238393Z"}, {"uuid": "43f431fa-65d6-4314-ad73-802325c77f2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44329", "content": "Sangoma Switchvox Vulnerabilities Exploited in the Wild\n\nTracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution.\nThe post Sangoma Switchvox Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.\nhttps://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/", "creation_timestamp": "2026-09-18T12:00:05.107247Z"}, {"uuid": "866558ae-e557-40ea-a43a-01575177500c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://t.me/VulnerabilityNews/44271", "content": "Hackers exploit Sangoma Switchvox flaw to deploy reverse shells\n\nAttackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/", "creation_timestamp": "2026-09-18T12:00:06.097882Z"}, {"uuid": "eaff23f7-641f-4794-a701-0bb8b4094b0d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44329", "content": "Sangoma Switchvox Vulnerabilities Exploited in the Wild\n\nTracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution.\nThe post Sangoma Switchvox Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.\nhttps://www.securityweek.com/sangoma-switchvox-vulnerabilities-exploited-in-the-wild/", "creation_timestamp": "2026-09-19T00:00:37.327020Z"}, {"uuid": "57907c97-6e26-4536-867e-59b7fcbc3b6d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "seen", "source": "https://t.me/VulnerabilityNews/44290", "content": "CISA Adds Seven Known Exploited Vulnerabilities to Catalog\n\nCISA has added seven new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. \u00a0\nCVE-2026-9586 Sangoma Switchvox SQL Injection Vulnerability\u00a0\nCVE-2026-48710 Kludex Starlette HTTP Request/Response Smuggling Vulnerability\u00a0\nCVE-2026-49869 Kestra OSS OS Command Injection Vulnerability\u00a0\nCVE-2026-59822 BerriAI LiteLLM Improper Authentication Vulnerability\u00a0\nCVE-2026-82329 JFrog Artifactory Improper Authentication Vulnerability\u00a0\nCVE-2026-83548 SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability\u00a0\nCVE-2026-83549 SonicWall SMA1000 Appliances OS Command Injection Vulnerability\u00a0\nThese types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.\u00a0\nBinding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA\u2019s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.\u00a0\nWhile BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria.\u00a0\nAware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA\u2019s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.\nhttps://www.cisa.gov/news-events/alerts/2026/09/02/cisa-adds-seven-known-exploited-vulnerabilities-catalog", "creation_timestamp": "2026-09-19T00:00:36.430793Z"}, {"uuid": "a06c7d7f-176c-4f85-8cff-1a16a3161115", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-9586", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44271", "content": "Hackers exploit Sangoma Switchvox flaw to deploy reverse shells\n\nAttackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in the Sangoma Switchvox VoIP platform that can lead to remote code execution. [...]\nhttps://www.bleepingcomputer.com/news/security/hackers-exploit-sangoma-switchvox-flaw-to-deploy-reverse-shells/", "creation_timestamp": "2026-09-19T00:00:35.547489Z"}]}