CVE-2026-9586

Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

9.3 CriticalIn KEVPublic exploit

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

19.0%Up 18.6 points since Jul 18, 2026

What each source reports

CVE List Score used 9.3

Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB

Record: CVE-2026-9586
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-89
Updated: 2026-11-02

EUVDEUVD-2026-45205 9.3

Record: EUVD-2026-45205
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-m32j-v93f-gfgc 9.3

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...

Record: GHSA-m32j-v93f-gfgc
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

CISA KEV No score

Sangoma Switchvox SQL Injection Vulnerability

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

Record: CVE-2026-9586
Weakness: CWE-89
Updated: 2026-11-02

NVD 9.3

Record: CVE-2026-9586
CVSS 4.0: 9.3 CriticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-89
Updated: 2026-11-02

Affected products

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	HORKimhab/CVE-2026-9586	2026-09-02
PoC in GitHub	fromABUV/CVE-2026-9586_POC_EXPLOIT	2026-10-12
Nuclei	Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection

History

History
Recorded	Changed	Sources
Nov 3, 2026	exploitation, exploits
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-9586 is a critical vulnerability (CVSS 9.3) in Sangoma Switchvox, published July 17, 2026. CISA lists it as known to be exploited, since September 2, 2026. EUVD reports exploitation since September 2, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.0%, the 97th percentile. No source names a fixed version.