CVE-2026-9586 is a vulnerability classified as Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), affecting Switchvox SMB Edition (affected versions: 8.3 (104997) – < 8.4.0.2). This vulnerability is rated Critical, with a CVSS score of 9.3. This vulnerability has been observed being exploited in the wild.
A short verification protects the vulnerability source and prevents automated AI abuse.
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
en
