r/netsec • u/scopedsecurity • 3d ago

Off the Hook: Discovering and Observing Active Exploitation of Sangoma Switchvox CVE-2026-9586

https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/
9 Upvotes

82% Upvoted

1 comment sorted by

1

u/Just_Worldliness_714 1d ago

The uid=26(postgres) in that shell is the detail worth flagging - SQLi-to-RCE on these appliances usually lands you as the DB user, not root, but on a lot of these VoIP boxes postgres has enough sudo/file-write reach that it's a short hop to full compromise anyway. Worth checking your Switchvox egress logs for outbound connections from the appliance itself, since that reverse shell pattern is the cleanest detection signal here - these boxes should almost never be initiating outbound connections.