🔴

CISA Known Exploited Vulnerability

This CVE is actively exploited in the wild. CISA mandates federal agencies to patch immediately.

CVE

CVE-2026-9586

9.3

CVSScritical

Exploitable remotely over the internet · no authentication required.

Description

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Attack Vector

Network

Privileges Req.

None

User Interaction

None

switchvox smb edition

Updated Nov 10, 2026View on NVD →

S4E scanner

criticalWeb Vulnerabilities~10 seconds

Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection

Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint (PhoneAppsHandler.pm). The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An attacker can break out of the single-quoted SQL string context and leverage PostgreSQL COPY TO PROGRAM to execute arbitrary operating system commands without authentication. References: https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/ https://nvd.nist.gov/vuln/detail/CVE-2026-9586 Remediation: Upgrade Sangoma Switchvox to version 8.4.0.2 or later which parameterizes the SQL query and validates the PhoneIP input.

9 assets checked · domain, subdomain, ipv4

Scanner page →Run scanner

CVE history: switchvox smb edition

Predict next CVE date with AI

Monitor this CVE on your assets

S4E maps published CVEs to scanners and forecasts the next disclosure window for your stack.

Create a free account →