Threat actors are actively exploiting a critical unauthenticated SQL injection vulnerability (CVE-2026-9586) in Sangoma Switchvox SMB Edition. This flaw allows for remote code execution, enabling attackers to deploy reverse shells without requiring any credentials. Organizations using the affected VoIP platform should prioritize patching to prevent unauthorized access and system compromise.