CVE-2026-9586

Published on July 17, 2026

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Early warning: exploitation observed

Exploitation observed since Sep 1, 2026
Not yet in the official CISA catalogue
First attack observed 45 days after disclosure

Source: VulnCheck KEV · Sep 1, 2026 Sep 1, 2026 Sep 1, 2026 Sep 1, 2026

Weakness type (CWE)CWE-89

Switchvox sotto attacco: SQL injection critica installa reverse shell senza credenziali

Vulnerabilities

Switchvox Under Attack: Critical SQL Injection Installs Reverse Shell Without Credentials

Hackers actively exploit CVE-2026-9586, a critical unauthenticated SQL injection in Sangoma Switchvox SMB, to deploy reverse shells. Patch to 8.4.0.2 now.

Sep 2, 20265 min readRead

This product uses the NVD API but is not endorsed or certified by the NVD.

CVE database

Early warning: exploitation observed

Related articles

Switchvox Under Attack: Critical SQL Injection Installs Reverse Shell Without Credentials