Patch Forecast
Red warning
Act within 24 hours. CISA deadline for US federal agencies: 5 Sep 2026.

CVE-2026-9586 Exploited in the wild

Sangoma Switchvox SQL Injection Vulnerability

Risk score
94/100
CVSS
9.8 v3.1
Published
17 Jul 2026
Added to CISA's exploited list
2 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated re…
Affected
Sangoma Switchvox
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
Exploited in the wild

Story map

Story map: Sangoma SwitchvoxTHE FLAWSTHE FIXCVE-2026-9586Sangoma Switchvox SQLInjection VulnerabilityCVSS 9.8 · exploitedFixApply the vendor's securityupdate; see the linked advisory.Who is exposedSangoma SwitchvoxRED · ACT TODAYSangomaSwitchvoxAn unauthenticated SQLinjection vulnerability exists inSangoma Switchvox SMB Edition8.3 (104997). The /pa endpointprocesses XML contentbeginning with<PolycomIPPhone> and directly…Where it standsExploited in the wildOn CISA's exploited list since 2 SepUS federal deadline 5 SepHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.2 Sep · CISAAdded to the Known Exploited Vulnerabilities list5 Sep · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessSQL injection (CWE-89)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Sangoma Switchvox: Red, act today. An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated re…

The flaws

  • CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability (CVSS 9.8 · exploited)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Sangoma Switchvox

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 2 Sep
  • US federal deadline 5 Sep

How it unfolded

  1. 2 Sep, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 5 Sep, Deadline (official): US federal agencies must have patched

Connects to

Why it is Red

  • CVSS 9.8 critical
  • Exploited in the wild (CISA KEV)
  • Public exploit or proof of concept referenced
  • Remotely exploitable without logging in

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

Original description

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Last activity 2 Sep 2026. Patch Forecast updates every hour.