CVE-2026-9585
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
An unauthenticated reflected XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to sanitize the 'portal' parameter in invalid_browser and invalid_browser_login handlers, allowing attacker-controlled script execution in a victim's browser.
Risk Assessment
An attacker can hijack user sessions, steal credentials, or perform other malicious actions in the victim's browser context without requiring authentication.
Recommendation
Immediately update Sangoma Switchvox SMB Edition to the latest available version that fixes this vulnerability. Until then, restrict access to the administrative interface to trusted networks only.
Other vulnerabilities in Sangoma Switchvox SMB Edition
See all- CVE-2026-9586Critical
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
- CVE-2026-9588High
A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript to be stored server-side and rendered to other users.
Original NVD description (English source)
An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_login handlers. User-supplied data is reflected into JavaScript generated by the application, allowing attacker-controlled script execution within a victim's browser.