CVE-2026-9586
Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB
CVSS Score
0.0
EPSS Score
1.1%
EPSS Percentile
63th
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
| CWE | CWE-89 |
| Vendor | sangoma |
| Product | switchvox smb edition |
| Published | Jul 17, 2026 |
| Last Updated | Sep 3, 2026 |
⚠️ Actively Exploited — Act Now
Get instant alerts for sangoma switchvox smb edition
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2026-9586.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Sangoma / Switchvox SMB Edition
8.3 (104997) < 8.4.0.2
References
sangomakb.atlassian.net: https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 labs.sra.io: https://labs.sra.io/posts/switchvox/ horizon3.ai: https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/# cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586
Credits
Cam Lischke (SRA)