CVE-2026-9586: Critical SQL Injection in Sangoma Switchvox, Actively Exploited

CVE-2026-9586: Critical SQL Injection in Sangoma Switchvox, Actively Exploited

In short

CVE-2026-9586 is a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997), with a CVSS score of 9.3 out of 10 and severity rated as critical [1]. It was published on July 17, 2026 [1] and is listed in CISA's KEV (Known Exploited Vulnerabilities) catalog, indicating that active exploitation has already been detected in the real world [2]. If your organization uses Sangoma Switchvox as a communications system (IP telephony / PBX), today's priority is to identify whether you have this product deployed, check the exact version, and limit the system's exposure while the corresponding security update is applied.

What it is and why it matters

The flaw resides in Switchvox's /pa endpoint, which processes XML content beginning with the <PolycomIPPhone> tag—that is, Polycom IP phone provisioning traffic. The user-controlled PhoneIP value is concatenated directly into PostgreSQL database queries without sanitization or parameterization [1]. This allows a remote attacker, without needing credentials, to send a single crafted request and execute arbitrary SQL statements against the database, including operations on stored data and remote code execution on the server [1].

This is a particularly dangerous combination: it requires no prior authentication, is triggered with a single request, and the impact extends beyond "reading data" to potentially compromising the server itself. Our OCIRIA intelligence radar has internally classified this vulnerability as critical, within the category of SQL injection with potential for remote code execution; this is an internal analysis built on the same public NVD and CISA KEV data already cited, not an additional independent source [1][2].

Who it affects

It specifically affects organizations operating Sangoma Switchvox SMB Edition version 8.3 (104997) [1]. Switchvox is a unified communications platform (IP telephony, messaging, extension management) typically deployed as a company's central telephony system, so its compromise can affect both the availability of communications and the confidentiality of data stored in its database. The structured ground truth we work from does not include data on the size or sector of affected organizations, so we avoid speculating on that point: what matters is identifying whether the specific product and version are in use.

How to know if you're vulnerable

• Check whether your organization has Sangoma Switchvox SMB Edition deployed and, if so, verify the exact installed version; the vulnerability has been identified in version 8.3 (104997) [1].
• Review whether the /pa endpoint of your Switchvox instance is accessible from outside your internal network, since this is precisely the point through which phone provisioning traffic that exploits this flaw is sent and processed [1].
• Since this is an unauthenticated vulnerability already included in CISA's KEV catalog due to active exploitation, any internet-exposed instance should be treated as an immediate risk until patching is confirmed [1][2].

How to protect yourself

1. Identify the asset. Locate all instances of Sangoma Switchvox in your inventory and confirm the version they are running.

2. Apply the vendor's security update as soon as it is available for your version, and prioritize this patching given that the vulnerability is already listed in CISA's KEV catalog due to known active exploitation [2].

3. Restrict access to the /pa endpoint and, more generally, to the Switchvox administration interface, so that it is only accessible from trusted networks while patching is completed.

4. Audit access and logs from the Switchvox server and the associated PostgreSQL database for anomalous requests to the /pa endpoint or unusual SQL activity, especially in the period following the vulnerability's publication (July 17, 2026) [1].

5. Document and monitor the patching status of this asset as part of your routine critical vulnerability management, given the assigned severity level (CVSS 9.3, critical) [1].

Frequently asked questions

Is this a critical vulnerability?

Yes. NVD assigns it a CVSS score of 9.3 out of 10 and classifies it as critical severity [1].

Is it being actively exploited?

CVE-2026-9586 is listed in CISA's KEV (Known Exploited Vulnerabilities) catalog, confirming known active exploitation [2].

Do I need to be authenticated to be affected?

No. The vulnerability can be exploited remotely and without any prior authentication, via a single crafted request to the /pa endpoint [1].

What do I gain by knowing if I'm vulnerable?

The ability to prioritize applying the security update and, in the meantime, reduce the system's exposure, rather than discovering the problem after an incident.

Sources

• [1] https://nvd.nist.gov/vuln/detail/CVE-2026-9586
• [2] https://raw.githubusercontent.com/cisagov/kev-data/develop/known_exploited_vulnerabilities.json