An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Critical 9.8Actively exploited
CVE-2026-9586
Sangoma Switchvox — SQL Injection.
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).
WeaknessCWE-89: SQL injection
Published Updated Source NVD and CISA KEV
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
19%
Higher than 97% of all CVEs (EPSS)
Status
Actively exploited
On CISA KEV since 2 Sep 2026
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run Sangoma Switchvox, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
- 03Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA deadlineUS federal agencies must remediate by
References
Timeline · UTC
- Published to NVD
- Added to CISA KEV
- CISA remediation deadline
- NVD record updated
Also actively exploited