CVE-2026-9586: Sangoma Switchvox unauthenticated SQL injection in /pa endpoint

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with RCE potential, a public exploit reference, and CISA KEV listing with a near-term remediation due date.

What it is

Sangoma Switchvox SMB Edition 8.3 (104997) fails to sanitize the PhoneIP value from XML content beginning with <PolycomIPPhone> before concatenating it into PostgreSQL queries at the /pa endpoint. An unauthenticated remote attacker can run arbitrary SQL against the backend database with a single crafted request. The flaw is critical because it requires no credentials or user interaction and can lead to remote code execution.

Impact

An attacker gains full read/write access to the backend PostgreSQL database and, per the description, can achieve remote code execution on the Switchvox host. This can expose or destroy telephony data and give the attacker a foothold on the appliance.

Attack surface

Reachable over the network via the /pa endpoint by sending crafted XML beginning with <PolycomIPPhone>; the CVSS vector shows PR:N and UI:N, so no authentication or user interaction is needed. Any internet- or network-exposed Switchvox instance with this endpoint is a candidate target.

Exploitation

CVE-2026-9586 is listed in CISA KEV (added 2026-09-02, due 2026-09-05) and a public exploit reference is tagged Exploit, indicating active exploitation. EPSS is 0.11845 (95.9th percentile), so exploitation is plausible and observed.

What to do

• Apply the vendor fix by upgrading to Switchvox 8.4.0.2 (July 14, 2026) or later per the release notes.
• If patching is not immediately possible, restrict network access to the /pa endpoint and remove internet exposure of the Switchvox appliance.
• Follow CISA BOD 26-04 guidance and the KEV required action, including forensics triage; discontinue use if mitigations are unavailable.
• Review and rotate any credentials or secrets stored in or reachable from the Switchvox PostgreSQL backend.
• Monitor vendor and CISA advisories for updated mitigation instructions.

Detection

• Inspect HTTP requests to /pa for XML bodies beginning with <PolycomIPPhone> and unexpected or malformed PhoneIP values.
• Look for SQL syntax, UNION, stacked-query or comment patterns in the PhoneIP parameter within web or WAF logs.
• Monitor PostgreSQL logs for anomalous queries or errors originating from the Switchvox application host.
• Hunt for unexpected outbound connections or new processes on the Switchvox appliance that could indicate post-exploitation RCE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.