by Kastro
Paper/Archive/CVE-2026-9586

CVE-2026-9586

Sangoma Switchvox SMB Edition — Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

KEV · due 5 SepEPSS 19%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (NVD)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 97.3.973 × 2019.5Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Affected

ProductAffectedFixed inSource
Switchvox SMB Edition8.3 (104997) – < 8.4.0.28.4.0.2CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SRA (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refsangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026writeuplabs.sra.io/posts/switchvoxwriteuphorizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586kevcisa.gov/known-exploited-vulnerabilities-catalog