A phone system field meant to hold a Polycom handset’s IP address turned out to be a direct line into a PostgreSQL database with superuser rights — and by the time anyone outside Sangoma knew about it, attackers had already worked out how to ride that line all the way to a root shell. Horizon3.ai’s researchers reported the bug in April 2026. Sangoma patched it in July. On 30 August, honeypots watching for exactly this attack started recording it happening for real.

An XML tag with no manners

Switchvox, Sangoma’s small-business VoIP phone system, exposes an unauthenticated HTTP endpoint called /pa that exists to receive status notifications from Polycom desk phones. According to Horizon3’s technical writeup, the handler checks only that an incoming POST body starts with a <PolycomIPPhone> tag, then parses the rest as XML and pulls out a PhoneIP value. That value is meant to be an IP address. Instead of being validated as one, it gets concatenated directly into a SQL query string that Switchvox’s tel_notify() function runs against its PostgreSQL backend — no parameterization, no escaping, no authentication required to reach any of it.

From there the path to code execution is a known one: PostgreSQL’s COPY TO PROGRAM command lets a query pipe its output into an arbitrary shell command, running with whatever privileges the database connection holds. Horizon3 says that connection runs as PostgreSQL superuser, which is effectively total control of the box. Their own proof-of-concept used COPY TO PROGRAM to open a reverse shell with nc; the attackers Horizon3 later caught in its honeypots used the identical technique, down to the same nc | sh pattern, against a different IP.

Reported in April, patched in July, exploited in August

The timeline matters here as much as the bug. Horizon3 reported this flaw — one of twelve it found in Switchvox — to Sangoma on 10 April 2026 and had a pre-release patch to validate by 21 April. Sangoma shipped the fix, version 8.4.0.2, on 14 July. Horizon3 seeded honeypots to watch for exploitation in early May, well before the patch even landed, anticipating that a public writeup — or simple binary diffing of the patched release against the old one — would eventually hand attackers the same bug.

That’s what happened. On 30 August, Horizon3’s honeypots recorded exploitation attempts from a single IP address, 176.65.148.184, sending the same PolycomIPPhone payload pattern against multiple sensors in quick succession. Zach Hanley, the Horizon3 researcher who published the disclosure, called the pattern deliberate: “Given the quick succession of exploit attempts across multiple honeypots from the same source IP, we believe that it is likely that most internet exposed Switchvox instances will be or have already been targeted.” By 2 September, BleepingComputer reported dozens of additional source IPs had joined in, with some now dropping second-stage cryptomining malware after the initial reverse shell.

Shodan scans cited in Horizon3’s writeup put roughly 4,000 internet-exposed Switchvox instances online, most of them in the United States — the entire population of systems still running 8.3 or earlier is the attack surface. Horizon3 also notes that the injection leaves a trail: successful exploitation attempts show up in /var/log/switchvox/db-quirks.log on affected boxes, giving defenders a concrete place to check rather than having to guess whether they were hit.

A KEV listing puts a federal deadline on it

CVE-2026-9586 carries a CVSS 4.0 score of 9.3, and on 2 September 2026 CISA added it to its Known Exploited Vulnerabilities catalog alongside six other actively-exploited flaws, including the SonicWall SMA1000 chain and the Kestra and LiteLLM bugs Tech-Bee has covered separately. The Hacker News’s rundown of that batch describes the Switchvox flaw in almost identical terms to Horizon3’s own writeup: a single crafted HTTP request that lets an unauthenticated attacker “execute arbitrary SQL statements against the backend PostgreSQL database,” escalating from there to remote code execution. A KEV listing carries a federal remediation deadline — 5 September for this entry — a signal reserved for vulnerabilities CISA has independently confirmed are being exploited, not merely theorized about.

Twelve bugs, one that mattered most

Horizon3’s April disclosure to Sangoma wasn’t a single-bug report — it covered twelve separate vulnerabilities the firm found in Switchvox during one research pass. CVE-2026-9586 is the one that turned into a live incident, but the volume is itself worth noting: a single vendor audit surfacing a dozen flaws in one product is a sign of how much unexamined attack surface accumulates in appliance software that mostly runs unattended once it’s deployed, quietly handling phone traffic in a network closet somewhere until a researcher — or an attacker — finally looks closely at it.

Why a phone system is worth breaking into

Switchvox isn’t a target because of what it stores; it’s a target because of where it sits. Hanley’s disclosure describes exactly this: compromised VoIP servers function as “pivot points into organizations from external into internal networks.” A phone system typically has legitimate reasons to talk to a company’s internal network — extensions, voicemail servers, call routing — which makes it a plausible-looking hop for an attacker who has just landed a root shell on an internet-facing box and now needs to reach something more valuable behind it.

The lessons that generalise

A patch’s release date is not when the clock starts — the disclosure report date is. Horizon3 reported this bug in April; Sangoma’s July patch gave attackers a functioning before-and-after diff to reverse engineer. Four and a half months of lead time between report and in-the-wild exploitation is not evidence of a slow attacker — it’s evidence that unpatched systems stay exploitable for as long as they stay unpatched, regardless of how old the underlying bug report is.

Any field that claims to hold a fixed-format value — an IP address, a phone extension, a MAC address — needs to be validated as that format, not merely well-escaped as a string. The PhoneIP field’s actual sin wasn’t missing escaping; it was being trusted to already look like an IP address when nothing enforced that. Format validation and injection defense are two different controls, and this bug shows what happens when a system only has one of them.

Database accounts used by application code should never hold superuser privileges. Every step of this exploit chain — the injection, the COPY TO PROGRAM pivot, the resulting shell — depends on the Switchvox application’s database connection having far more power than serving phone-status callbacks requires. A scoped, least-privilege database role would have turned a SQL injection into an information-disclosure bug instead of a root compromise.

Edge appliances with no obvious “crown jewel” data are still worth attacking, because they’re worth standing on. A VoIP box is a foothold, not a payday, and treating internet-facing infrastructure as low-priority because it doesn’t hold customer records misreads what attackers actually want from it.

Tech-Bee is an independent technology publication. This piece is drawn from Horizon3.ai’s technical disclosure of CVE-2026-9586, and from reporting by BleepingComputer, Help Net Security and SentinelOne’s vulnerability database.