CVE-2026-9588: Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submitmodifyvoicemailtemplate endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the templatetext parameter to be stored server-side and subsequently rendered to other users.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9588?
CVE-2026-9588 has a high severity rating of 7 based on the CVSS scoring system.
How do I fix CVE-2026-9588?
To fix CVE-2026-9588, upgrade to Sangoma Switchvox SMB Edition version 8.4 or later, which addresses the vulnerability.
What type of vulnerability is CVE-2026-9588?
CVE-2026-9588 is an authenticated stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-9588?
Users of Sangoma Switchvox SMB Edition version 8.3 (104997) are affected by CVE-2026-9588.
What can an attacker do with CVE-2026-9588?
An attacker can exploit CVE-2026-9588 to inject malicious scripts through the voicemail notification template functionality.