SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-9586

CRITICAL · CVSS 9.3 EPSS 0.41% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-17 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

An unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 allows remote attackers to manipulate PostgreSQL queries by injecting malicious PhoneIP values through the /pa endpoint. This can lead to unauthorized database operations and potential remote code execution. Organizations using this version of Switchvox should prioritize patching to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Detected Signals
remote code execution code execution

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-9586
Severity
CRITICAL
CVSS
9.3
EPSS
0.41%

Original NVD Description

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.