CVE-2026-9586: Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

Published Jul 17, 2026

Updated

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Affected Software

1 affected component

Sangoma Switchvox SMB Edition=8.3 (104997)

Event History

Jul 17, 2026

CVE Published

via MITRE·03:57 PM

Data Sourced

via MITRE·03:57 PM

DescriptionWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Mar 20, 58616

Event

via FIRST·01:15 AM

Frequently Asked Questions

What is the severity of CVE-2026-9586?

The severity of CVE-2026-9586 is critical, with a CVSS score of 9.3.

How do I fix CVE-2026-9586?

To fix CVE-2026-9586, upgrade to Sangoma Switchvox SMB Edition version 8.4.0.2 or later.

What can be exploited in CVE-2026-9586?

CVE-2026-9586 can be exploited through unauthenticated SQL injection leading to remote code execution.

What software is affected by CVE-2026-9586?

The affected software is Sangoma Switchvox SMB Edition version 8.3 (104997).

What is the impact of CVE-2026-9586?

The impact of CVE-2026-9586 includes potential remote code execution due to the vulnerability.