Read the docs
TI-2026-08422 Aliases CVE-2026-9586GHSA-m32j-v93f-gfgc

Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

Priority CRITICAL 99Exploited in the wildCWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Why it matters now

Exploitation Active In CISA KEV since 2026-09-02CISA due date 2026-09-05
EPSS 0.18979 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Switchvox SMB Edition (Sangoma): 8.4.0.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SangomaSwitchvox SMB Edition8.3 (104997) to before 8.4.0.28.4.0.2Patch availableCNA
  • Switchvox SMB Edition VendorSangoma Affected 8.3 (104997) to before 8.4.0.2 Fixed in 8.4.0.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:sangoma:switchvox:*:*:*:*:on-premises:*:*:*8.2.2.1 to before 8.4.0.2VulnerableSangoma
  • cpe:2.3:a:sangoma:switchvox:*:*:*:*:on-premises:*:*:* Versions 8.2.2.1 to before 8.4.0.2 Vulnerable ·Sangoma

Remediation

  • Fix · CNA Switchvox SMB Edition (Sangoma) Fixed in 8.4.0.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Sangoma Switchvox SMB Edition 8.4.0.2

    4 records Highest priority Priority CRITICAL 1 CRITICAL, 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-08421 Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web PortalPriority MEDIUM 40
    • TI-2026-08424 Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web PortalPriority LOW 31
    • TI-2026-08423 Authenticated Local File Inclusion (LFI) in Switchvox SMB Web PortalPriority LOW 31
    Show all 4 records →

Timeline

  1. 2026-09-02 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-9586
  3. 2026-10-03 Alias added: GHSA-m32j-v93f-gfgc

References

Exploit 1

Advisory 2

Other 1

  • TI-2021-20477 Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information… CVSS 3.1MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences