CVE-2026-9586 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-07-17

Added to CISA KEV: 2026-09-02 47 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL PRIORITY — PATCH IMMEDIATELY: Upgrade Sangoma Switchvox SMB Edition to version 8.4.0.2 or later. This vulnerability is in CISA KEV with confirmed active exploitation — treat as emergency patching.
CRITICAL: Conduct immediate incident response — review /pa endpoint access logs for unexpected or malformed XML requests, particularly those containing SQL metacharacters (single quotes, semicolons, UNION, SELECT, COPY, etc.) in the PhoneIP field.
CRITICAL: Check for indicators of compromise including unexpected processes spawned by the PostgreSQL service user, new user accounts, scheduled tasks/cron jobs, outbound connections to unknown IPs, and web shells in the web root.
IMMEDIATE NETWORK MITIGATION: If patching cannot be applied immediately, restrict access to the /pa endpoint via firewall rules — allow only known Polycom phone IP addresses and block all other internet sources.
NETWORK SEGMENTATION: If not already implemented, place the Switchvox appliance behind a firewall that blocks direct internet access to provisioning endpoints. Use a VPN or zero-trust model for remote phone provisioning.
MONITORING: Deploy WAF rules or IDS signatures to detect POST requests to /pa containing XML with SQL injection patterns in PhoneIP values.
POST-PATCH AUDIT: After patching, perform a full security audit of the Switchvox system including database integrity checks, OS user accounts, and installed files to verify no persistence was established prior to patching.
PATCH PRIORITY: CRITICAL — patch within 24 hours given CISA KEV status and confirmed active exploitation with automation capability.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-9586 is a critical unauthenticated SQL injection vulnerability affecting Sangoma Switchvox SMB Edition, specifically version 8.3 (104997). The vulnerability resides within the `/pa` HTTP endpoint, which is designed to process phone notification requests. Because the application fails to properly sanitize or parameterize user-controlled input (specifically XML content containing a `PhoneIP` value) before concatenating it into backend PostgreSQL database queries, a remote, unauthenticated attacker can execute arbitrary SQL statements. This flaw is highly significant because it can be leveraged to achieve remote code execution (RCE) on the affected appliance ^[1]^[2].

Exploitation

Active Exploitation: The vulnerability is actively exploited in the wild and is listed in the CISA Known Exploited Vulnerabilities (KEV) Catalog ^[1]^[3].
Threat Actors: While specific ransomware campaigns or named threat actors were not explicitly identified in the available summaries, the inclusion in CISA’s KEV catalog indicates widespread interest and utilization by malicious actors ^[3].
PoC/Exploits: Proof-of-concept information and evidence of exploitation attempts have been documented, highlighting the ease of weaponization ^[1]^[2].
Prerequisites:

- Network vs Local: Network-accessible; the endpoint is reachable over the network ^[4]. - Authentication: None required (unauthenticated) ^[1]. - User Interaction: None required ^[1].

Affected Products & Patches

Affected Product: Sangoma Switchvox SMB Edition 8.3 (104997) ^[5].
Patch/Hotfix: Users are advised to check the official Sangoma security advisories for the specific patch or updated version addressing this issue.
Mitigation/Workarounds: Given the critical nature of the vulnerability and the lack of authentication, disabling access to the `/pa` endpoint from untrusted networks is the recommended immediate mitigation if patching is not immediately feasible.

Impact

Access/Capability: Successful exploitation allows an attacker to execute arbitrary SQL commands against the backend PostgreSQL database. This can be escalated to achieve full remote code execution on the appliance, providing the attacker with complete control over the system ^[1].
Business Risk: For internet-facing deployments, this vulnerability poses an extreme risk, as it allows unauthorized remote attackers to compromise the voice communication infrastructure, potentially leading to data breaches, eavesdropping, system disruption, or the deployment of ransomware within the organization’s network ^[1].

Sources

CVE-2026-9586: Sangoma Switchvox RCE | Horizon3
CVE-2026-9586 is a critical unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition that allows a remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database and achieve remote code execution without authentication or user interaction. The vulnera…
CVE-2026-9586 - Exploits & Severity - Feedly
CVEs. CVE-2026-9586. TrendingPoCFeedly KEVCISA KEV.Summary. An unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL…
Known Exploited Vulnerabilities Catalog
CVE-2026-9586. Sangoma Switchvox SQL Injection Vulnerability: Sangoma Switchvox contains a SQL injection vulnerability which allows an ...
CVE-2026-9586 - Vulnerability Details - OpenCVE
The vulnerability is listed in CISA’s KEV catalog. Due to the absence of authentication required and the ability to reach the vulnerable endpoint over the network, the likely attack vector is an unauthenticated remote attacker sending crafted XML to the /pa service. Generated by OpenCVE AI on Septem…
NVD-CVE-2026-9586 - National Vulnerability Database
Description. An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes ...

🔴 CVE-2026-9586