Threat Actors Actively Exploiting Critical Sangoma Switchvox Vulnerability (CVE-2026-9586)

A critical SQL injection vulnerability, CVE-2026-9586, in Sangoma Switchvox SMB Edition 8.3 is being actively exploited by threat actors. The flaw allows unauthenticated attackers to execute arbitrary SQL statements and potentially gain remote code execution on internet-exposed instances of the enterprise VoIP platform. Patches were released in July, but exploitation attempts began on August 30, 2026.