CVE-2026-9588
HighCVSS 7.0Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript to be stored server-side and rendered to other users.
Risk Assessment
An attacker with a user account can inject a persistent XSS script that executes in the browsers of other administrators or users, potentially leading to session theft, account takeover, or theft of sensitive data.
Recommendation
Immediately update Sangoma Switchvox SMB Edition to the latest patched version. Until the update is applied, restrict access to the template management functionality to trusted administrators only.
Other vulnerabilities in Sangoma Switchvox SMB Edition
See all- CVE-2026-9586Critical
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
- CVE-2026-9585High
An unauthenticated reflected XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to sanitize the 'portal' parameter in invalid_browser and invalid_browser_login handlers, allowing attacker-controlled script execution in a victim's browser.
Original NVD description (English source)
A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the template_text parameter to be stored server-side and subsequently rendered to other users.