Hackers exploit Sangoma Switchvox flaw for reverse shells

Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox's /pa HTTP endpoint, to execute commands and establish reverse shells. Horizon3 reported 12 flaws on April 10; Sangoma fixed them in version 8.4.0.2 on July 14. Roughly 4,000 devices are internet-exposed, mostly in the US.