CVE-2026-9586 Sangoma Switchvox SQL Injection
Unauthenticated attackers can exploit SQL injection in the /pa endpoint to execute arbitrary SQL and achieve remote code execution on Switchvox SMB.
- Exploited in the wild
- Since 2 Sep 2026
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-9586?
CVE-2026-9586 is a critical SQL injection vulnerability in Sangoma Switchvox SMB Edition, published on 17 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Weakness: CWE-89
Which versions are affected by CVE-2026-9586?
It affects 1 product.
Products include Sangoma Switchvox.
How do I fix CVE-2026-9586?
No fix has been published for CVE-2026-9586 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 5 Sep 2026.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2026-9586 being exploited?
Yes. Attackers have exploited CVE-2026-9586 in the wild since at least 2 Sep 2026.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Other vulnerabilities in Sangoma Switchvox SMB Edition
Sources
Also known as GHSA-m32j-v93f-gfgc.