CVE-2026-9586 Sangoma Switchvox SMB Edition
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries…
- CVSS
- 9.3 Critical
- EPSS
- 19%
- Percentile
- 97
- Published
- 2026-07-17
- Force
- 10 of 12
- Public PoC
- 2
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
On CISA’s exploited list
Sangoma Switchvox SQL Injection Vulnerability
- Added
- 2026-09-02
- Federal patch deadline
- 2026-09-05
- Ransomware use
- not known