CVE-2026-9586

This vulnerability is like a lock that doesn’t require a key: an attacker can send a specially built message to a specific Switchvox network address and trick the system into running attacker code. In reported cases, attackers are using it to create “reverse shells,” which can give them remote control of your server. If your Switchvox system is reachable from outside your trusted network, this can quickly become a full compromise.

This matters if you run Sangoma Switchvox SMB Edition (specifically 8.3 (104997)), because the flaw is unauthenticated and can be triggered over the network. It is a risk when the vulnerable /pa endpoint is reachable from an attacker-controlled network path (for example, exposed to the internet or other untrusted networks). The attack requires no login and no user interaction.

This is RED because attackers are actively exploiting this vulnerability in the wild, including using reverse shells. The weakness is unauthenticated, so a compromised system can be reached without stealing passwords or tricking users. CISA has added it to KEV with an early remediation deadline of 2026-09-05.