Sangoma Switchvox CVE-2026-9586 Just Hit CISA’s Exploited List

If you run a 10–20 person shop in Staten Island, Brooklyn, Queens, or Midtown, the phone system is usually the last box anyone wants to touch. Calls still ring. The receptionist still transfers. So the beige appliance in the closet stays powered on, still has a public IP, and still answers strangers on the internet.

On September 2, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-9586 — a Sangoma Switchvox SQL injection vulnerability — to its Known Exploited Vulnerabilities (KEV) catalog. The same batch included the SonicWall SMA1000 entries we already covered. This post is about the phone box, not another firewall story. See our earlier note on the SonicWall SMA1000 KEV if that is the appliance you actually own.

CISA’s KEV feed (catalog version 2026.09.02) lists a federal due date of September 5, 2026, marks ransomware campaign use as Unknown, and marks forensic triage required: Yes. That federal clock binds Federal Civilian Executive Branch agencies under Binding Operational Directive (BOD) 26-04. It is not a New York statute that automatically fines a private LLC. Treat the listing as urgency for any internet-facing Switchvox, not as a lawsuit deadline for your firm.

What CISA listed for Sangoma Switchvox (CVE-2026-9586)

Per the CISA KEV JSON feed, CVE-2026-9586 is a Sangoma Switchvox SQL injection vulnerability. The short description is blunt: an unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution. Related weakness: CWE-89. Notes point at Sangoma’s Switchvox 8.4.0.2 release notes, BOD 26-04, and the NVD entry.

The National Vulnerability Database record (published July 17, 2026; last modified September 3, 2026) names Sangoma Switchvox SMB Edition 8.3 (build 104997). NVD describes an unauthenticated SQL injection on the /pa HTTP path used for phone-notification style XML traffic. User-controlled input is concatenated into PostgreSQL queries without parameterization. CVSS 4.0 base score in NVD is 9.3 Critical.

In plain English: someone who is not logged in may be able to abuse a phone-system web path that should never be open to the whole internet. You do not need a novel exploit narrative. You need to know whether you still run Switchvox, whether it is reachable from outside, and whether it is on the fixed build.

What researchers and the vendor already said

Horizon3 independently reported Switchvox issues to Sangoma on April 10, 2026. Sangoma acknowledged the same day and provided a pre-release build on April 21. Sangoma released Switchvox 8.4.0.2 on July 14, 2026. The CVE became public on July 17. Horizon3, working with Defused Cyber honeypots, observed valid exploitation attempts on August 30, 2026, and published its write-up on September 1, 2026.

Horizon3’s affected range is Switchvox SMB Edition 8.3 (104997), versions less than 8.4.0.2. Sangoma’s own 8.4.0.2 release notes (Switchvox version 8.4.0.2 / build 105309) list CVE-2026-9586 as unauthenticated RCE via SQL injection and describe the issue against Switchvox 8.2.2.1. Those version labels do not line up cleanly. Do not invent a “safe older build.” If you still run Switchvox, move to 8.4.0.2 or later from Sangoma’s channels.

BleepingComputer (Bill Toulas, September 2, 2026) summarized the same research: active exploitation attempts, reverse-shell style activity against honeypots, and Horizon3’s warning that most internet-exposed Switchvox instances will be or have already been targeted. Horizon3, quoted there, also said Shodan showed approximately 4,000 devices on the internet, most in the United States. That is a global exposure signal from researchers — not a claim that your specific NYC block was hit. We will not invent a borough infection count.

This article will not walk through exploit requests, XML fields, or database tricks. Those belong in vendor and researcher advisories for defenders who already have a lab. Your job this week is inventory, patch, exposure reduction, and a light triage if the box was internet-facing.

What BOD 26-04 does — and does not — mean for a NYC SMB

BOD 26-04 is compulsory direction to Federal Civilian Executive Branch departments and agencies. The directive text is clear about that scope. It is not a New York State fine schedule for a 12-person dental office in Bay Ridge or a law practice near the ferry.

What private firms should still take from CISA’s September 2 alert:

• KEV means exploitation in the wild is the prioritization signal, not a CVSS argument on a Tuesday.
• CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation even when BOD 26-04 does not legally bind them.
• When a KEV entry marks forensic triage Yes, treat internet exposure as a reason to look for compromise before you wipe evidence.
• If contracts incorporate federal cybersecurity baselines, ask counsel or your MSP how those flow down. Do not assume September 5 is your private-firm legal deadline by default.

For New York vendor-risk conversations that do apply when someone else runs your stack, see our earlier note on NYDFS, MSPs, and what to ask your provider. That is a different lane from BOD 26-04. Keep them separate.

Why leftover Switchvox boxes show up in small NYC shops

Switchvox sits in the business phone lane: extensions, voicemail, call queues, sometimes softphones. In a 15-user firm the story is familiar:

• Someone bought an on-prem Sangoma/Switchvox system years ago because desk phones had to work.
• Staff later added Microsoft Teams calling, a hosted PBX, or a different VoIP vendor — but the old appliance still has power and a public IP.
• The only person who knew the admin password left. DNS still points phones.yourfirm.com or a raw IP at the closet.
• Firewall NAT for SIP/HTTP management was never cleaned up after the “temporary” remote-work change.

That pattern is why edge appliances, print servers, and databases keep rotating through KEV. Different products. Same lesson: shadow gear is the risk. We have already written the parallel stories for PaperCut NG/MF and SQL Server on KEV. Today’s question is whether a Switchvox is still answering from the street.

A practical checklist for a 15-user NYC firm

No exploit steps. No payloads. Defender work you can finish this week.

1) Find every Switchvox (and lookalikes)

• Ask whoever handles phones/firewall/DNS: any Sangoma Switchvox, Switchvox SMB, or “on-prem Sangoma phone server” still online?
• Check public DNS for phones., pbx., voip., sip. hostnames.
• Review firewall NAT for HTTP(S) management and SIP/RTP paths pointed at an internal or DMZ host.
• Look at your MSP’s RMM or asset list for Sangoma / Switchvox inventory records.
• If you moved to a hosted phone platform, confirm the old appliance is powered off and decommissioned — not just unused.

2) Record version and exposure

• From a management path you already trust, capture model, serial, and software version/build.
• Answer yes/no: is the Switchvox web/admin interface reachable from the public internet without a VPN in front?
• Answer yes/no: are phone-provisioning or notification HTTP paths reachable from the internet?
• Photograph or export the version screen. You will need it when you compare against 8.4.0.2.

3) Patch from the vendor release notes — not from a blog

• Open Sangoma’s Switchvox 8.4.0.2 release notes and apply the vendor upgrade path to 8.4.0.2 or later.
• Because vendor notes and the CVE/CNA text disagree on earlier version labels, do not argue that “we are on 8.2.x so we are fine.” Upgrade.
• Use Sangoma’s channels. Do not apply random firmware from a forum mirror.

4) Restrict exposure while you patch

• Preferred: remove public inbound access to Switchvox management and phone-notification HTTP paths. Put admin access on VPN, jump host, or allowlisted management IPs only.
• If desk phones still need the appliance, shrink who can reach it. “Everyone on the internet” is not a requirement for a 15-user firm.
• Rotate admin credentials after you regain control. Kill shared vendor accounts you no longer need.

5) Do a light forensic triage if it was internet-facing

CISA marks forensic triage Yes for this KEV entry. For a small firm, that does not mean cosplaying a federal incident-response playbook. It means:

• Preserve logs from the appliance and upstream firewall for the window around and before August 30–September 2, 2026.
• If you have SSH/admin access, Horizon3 recommends reviewing /var/log/switchvox/db-quirks.log for evidence of injected SQL, and correlating with odd outbound connections. BleepingComputer also notes researcher-observed attacker infrastructure activity (including an IP and port called out in that coverage). Treat those as hunt clues from named sources, not as proof your site was hit.
• Look for unexpected admin logins, new local accounts, unexplained reboots, or strange outbound sessions.
• If anything looks wrong — or you cannot get trustworthy logs — call your MSP or IR retainer before you wipe evidence.
• CISA’s ransomware field is Unknown. Absence of a ransomware tag is not a clean bill of health.

6) Decide keep vs retire

• If nobody needs the on-prem Switchvox anymore, decommission it. Powered-off on a shelf still beats internet-exposed and forgotten.
• If you still need desk phones, move to a maintained platform with MFA on admin, monitored logs, and no orphan public management path.
• Update the network diagram so the next hire does not rediscover a ghost PBX in 2027.

How this fits the wider KEV pace

KEV additions are arriving in clusters. Edge appliances, print servers, databases, and now leftover phone systems rotate through the same catalog. The pattern for NYC SMBs is not “memorize every CVE.” It is “keep an asset list, watch KEV for products you actually run, and kill internet exposure you cannot patch the same day.” For the broader tempo problem, see zero-day exploit velocity and critical vulnerabilities for NYC businesses.

What MicroSky will do if you call

MicroSky Managed Services works with NYC and Staten Island SMBs that do not have a full-time security team. On a Switchvox KEV day, a typical engagement looks like:

• Inventory: confirm whether you have Switchvox (or only a different Sangoma/VoIP product).
• Exposure check: management and phone HTTP paths from the internet, yes or no.
• Version capture and alignment to Sangoma 8.4.0.2+.
• Emergency exposure reduction (firewall rules / management allowlists) while patching.
• Log review for obvious compromise signals; escalate to deeper IR if needed.
• Retirement or replacement plan so phone admin is not a forgotten box again.

If you are not sure whether that beige appliance under the punch-down block is still live, do not guess. Call (718) 672-2177 or visit microskyms.com. Same-day clarity beats a weekend surprise.

Bottom line

CVE-2026-9586 put Sangoma Switchvox on CISA’s exploited list on September 2, 2026. It is an unauthenticated SQL injection issue that can reach remote code execution on the phone system. Ransomware use is Unknown. Federal agencies have a September 5 BOD 26-04 due date; private NYC firms should treat the listing as a patch-and-exposure emergency, not as automatic legal coverage under that directive. Find the box, read Sangoma’s 8.4.0.2 notes, restrict the internet path, patch from vendor guidance, and triage if it was exposed. Then decide whether that appliance still earns a place in your closet.

Need help tonight? Call MicroSky at (718) 672-2177 or go to https://microskyms.com.