[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-dLsPUbza3aK3EC4LlQrSzJlyiD4P0H2u7ssQI_LA_0":3},{"article":4,"iocs":54,"watch_terms":68,"solutions":69,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"b11d535e-b8a4-406d-bac0-499c54247fa6","Sangoma Switchvox Vulnerabilities Exploited in the Wild","sangoma-switchvox-vulnerabilities-exploited-in-the-wild-d0d77f","Tracked as CVE-2026-9586, the unauthenticated SQL injection flaw can be exploited remotely for arbitrary code execution. The post Sangoma Switchvox Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.","A critical SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox, a VoIP telephony management solution, is being actively exploited by threat actors. The flaw allows for remote code execution and has been added to CISA's Known Exploited Vulnerabilities catalog. Organizations are urged to patch immediately.","Sangoma Switchvox vulnerability CVE-2026-9586 is being exploited in the wild.","https:\u002F\u002Fwww.securityweek.com\u002Fsangoma-switchvox-vulnerabilities-exploited-in-the-wild\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F01\u002FCybersecurity_News-SecurityWeek.jpg","2026-09-04T13:23:12+00:00","2026-09-04T14:00:14.350866+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"Switchvox","product",{"name":21,"type":22},"Sangoma","vendor",{"name":24,"type":19},"Artifactory",{"name":26,"type":19},"SMA1000",{"name":28,"type":19},"Starlette",{"name":30,"type":19},"Kestra","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,65],{"type":56,"value":57,"context":58},"cve","CVE-2026-9586","Unauthenticated SQL injection vulnerability in Sangoma Switchvox allowing arbitrary code execution.",{"type":56,"value":60,"context":61},"CVE-2026-48710","HTTP request\u002Fresponse smuggling flaw in Starlette.",{"type":56,"value":63,"context":64},"CVE-2026-49869","Critical command injection defect in Kestra.",{"type":56,"value":66,"context":67},"CVE-2026-59822","High-severity authentication bypass in LiteLLM.",[21,18,24],{"controls":70,"vendors":154},[71,100,129],{"slug":72,"name":73,"problem":74,"products":75},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":101,"name":102,"problem":103,"products":104},"patch-management","Automated patch management","Known holes get closed in days, not months.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":53,"name":130,"problem":131,"products":132},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[133,141,149],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":150,"product_name":151,"url":152,"description":153},"dataminr-threat-intelligence","Dataminr Threat Intelligence","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fthreat-intelligence\u002F","Real-time alerts on emerging cyber threats, exploited vulnerabilities and attacks relevant to your organisation, detected with AI across a large set of public data sources.",[155,161,167,169,174],{"slug":156,"name":157,"logo_path":158,"roles":159},"horizon3-ai","Horizon3.ai","\u002Fvendor-logos\u002Fhorizon3-ai.png",[160],"reported_by",{"slug":162,"name":163,"logo_path":164,"roles":165},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png",[166],"affected",{"slug":106,"name":107,"logo_path":108,"roles":168},[160],{"slug":170,"name":171,"logo_path":172,"roles":173},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png",[166],{"slug":175,"name":176,"logo_path":177,"roles":178},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[160],{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":194},"active-exploitation-of-sangoma-switchvox-sql-injection-flaw-demands-immediate-patching","Active Exploitation of Sangoma Switchvox SQL Injection Flaw Demands Immediate Patching","A critical SQL injection vulnerability in Sangoma Switchvox (CVE-2026-9586) is being actively exploited in the wild, enabling threat actors to achieve remote code execution on affected VoIP systems. The root cause lies in insufficient input validation within the telephony management platform, a fundamental secure coding failure. Because VoIP systems are often internet-facing and deeply integrated into business communications infrastructure, a successful exploit can lead to call interception, data exfiltration, or full system compromise. CISA's addition of this CVE to its Known Exploited Vulnerabilities catalog signals that organizations still running unpatched versions face an imminent and credible threat. The severity underscores how legacy or under-monitored network appliances frequently become high-value targets when patches are not applied promptly.",[184,185,186,187,188,189,190,191,192,193],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-10: Information Input Validation","NIST SC-7: Boundary Protection (Network Segmentation)","CISA Known Exploited Vulnerabilities (KEV) Catalog","ITIL: Change and Release Management (Emergency Change procedure)","OWASP Top 10: A03 – Injection",{}]