CuraSec

tag: Voip · 2 items

Act archived Active exploitation of Sangoma Switchvox SQLi flaw deploys reverse shells
2026-09-03 · BleepingComputer · source ↗ #cve#voip#active-exploitation
  • Engineer — Act: CISA KEV-listed, public PoC on GitHub, and confirmed active exploitation: if you run Sangoma Switchvox, patch CVE-2026-9586 immediately or isolate the admin interface from untrusted networks until a patch is applied.
  • SOC/IR — Act: Attackers are landing reverse shells via unauthenticated exploitation on edge VoIP devices; hunt for anomalous outbound connections originating from Switchvox hosts and sweep for post-exploitation activity (new processes, lateral movement) since the vulnerability became public.
  • Leader — Plan: Confirm with engineering whether Switchvox is in the environment; if so, verify patching is prioritized this week given CISA KEV status — not yet a board-level event, but the KEV listing warrants a same-week check-in.
  • Signals: CVE-2026-9586 — CISA KEV: listed, EPSS 0.12, public PoC on GitHub, reported by 2 collected sources
Act archived Unauthenticated RCE Exploited in Sangoma Switchvox VoIP Platform
2026-09-02 · The Hacker News · source ↗ #voip#rce#active-exploitation
  • Engineer — Act: If you run Sangoma Switchvox SMB Edition 8.3, patch immediately — a public PoC exists and active exploitation is reported. Restrict network access to the Switchvox admin interface as an interim control while a patch is applied.
  • SOC/IR — Act: Active exploitation is deploying reverse shells from VoIP infrastructure; hunt for anomalous outbound connections originating from Switchvox hosts and sweep network logs for unexpected C2 traffic since the PoC went public.
  • Leader — Skip
  • Signals: CVE-2026-9586 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub