Actively exploited in the wild
Sangoma Switchvox SQL Injection Vulnerability
Sangoma - Switchvox · Listed in the CISA KEV since 2026-09-02. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-9586
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk96th percentile - higher than 96% of all known CVEs
Summary
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Risk Assessment
The risk for the organization includes full compromise of the PostgreSQL database, potentially leading to data breach, data modification or deletion, and possible remote code execution on the server.
Recommendation
Immediately upgrade Sangoma Switchvox SMB Edition to the latest available version that fixes this vulnerability. As a workaround, restrict access to the /pa endpoint to trusted IP addresses and deploy a Web Application Firewall (WAF) to block malicious XML requests.
Other vulnerabilities in Sangoma Switchvox SMB Edition
See all- CVE-2026-9588High
A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript to be stored server-side and rendered to other users.
- CVE-2026-9585High
An unauthenticated reflected XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to sanitize the 'portal' parameter in invalid_browser and invalid_browser_login handlers, allowing attacker-controlled script execution in a victim's browser.
Original NVD description (English source)
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.