CVE-2026-9586

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://labs.sra.io/posts/switchvox/	Third Party Advisory
https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026	Release Notes
https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#	Exploit Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

cpe:2.3:a:sangoma:switchvox:*:*:*:*:on-premises:*:*:*

History

24 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de inyección SQL no autenticada existe en Sangoma Switchvox SMB Edition 8.3 (104997). El endpoint /pa procesa contenido XML que comienza con [PolycomIPPhone] y concatena directamente el valor PhoneIP controlado por el usuario en consultas de PostgreSQL sin saneamiento ni parametrización. Un atacante remoto no autenticado puede ejecutar sentencias SQL arbitrarias contra la base de datos PostgreSQL de backend utilizando una única solicitud manipulada, incluyendo operaciones de base de datos y ejecución remota de código.

Information

Published : 2026-07-17 17:17

Updated : 2026-10-24 20:10

NVD link : CVE-2026-9586

Mitre link : CVE-2026-9586

CVE.ORG link : CVE-2026-9586

JSON object : View

Products Affected

sangoma

switchvox

CWE

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

{"id": "CVE-2026-9586", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-9586", "role": "CISA Coordinator", "options": [{"exploitation": "active"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-01T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "affectedData": [{"vendor": "Sangoma", "product": "Switchvox SMB Edition", "versions": [{"status": "affected", "version": "8.3 (104997)", "lessThan": "8.4.0.2", "versionType": "semver"}], "defaultStatus": "unknown"}]}], "published": "2026-07-17T17:17:18.150", "references": [{"url": "https://labs.sra.io/posts/switchvox/", "tags": ["Third Party Advisory"], "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8"}, {"url": "https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026", "tags": ["Release Notes"], "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8"}, {"url": "https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586", "tags": ["Third Party Advisory", "US Government Resource"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "description": [{"lang": "en", "value": "CWE-89"}]}], "descriptions": [{"lang": "en", "value": "An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997).\u00a0The /pa endpoint processes XML\u00a0content beginning with <PolycomIPPhone> and\u00a0directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization.\u00a0An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution."}, {"lang": "es", "value": "Una vulnerabilidad de inyecci\u00f3n SQL no autenticada existe en Sangoma Switchvox SMB Edition 8.3 (104997). El endpoint /pa procesa contenido XML que comienza con [PolycomIPPhone] y concatena directamente el valor PhoneIP controlado por el usuario en consultas de PostgreSQL sin saneamiento ni parametrizaci\u00f3n. Un atacante remoto no autenticado puede ejecutar sentencias SQL arbitrarias contra la base de datos PostgreSQL de backend utilizando una \u00fanica solicitud manipulada, incluyendo operaciones de base de datos y ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2026-10-24T20:10:00.137", "cisaActionDue": "2026-09-05", "cisaExploitAdd": "2026-09-02", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sangoma:switchvox:*:*:*:*:on-premises:*:*:*", "vulnerable": true, "matchCriteriaId": "A9E8D249-C33B-4FC1-8EF2-3FD26AA15547", "versionEndExcluding": "8.4.0.2", "versionStartIncluding": "8.2.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "57dba5dd-1a03-47f6-8b36-e84e47d335d8", "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "cisaVulnerabilityName": "Sangoma Switchvox SQL Injection Vulnerability"}