VULNERABILITY INTELLIGENCE

CVE-2026-9586

CVSS score9.8 CRITICAL
EPSS probability18.98%
CISA KEVKnown exploited vulnerability
Published2026-07-17
Last modified2026-10-24
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Sangoma Switchvox SQL Injection Vulnerability

Vendor / product: Sangoma / Switchvox

Description

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Weakness classification

  • 57dba5dd-1a03-47f6-8b36-e84e47d335d8: CWE-89

Primary references