/Vulnerability Library

Sangoma Switchvox < 8.4.0.2 - Unauthenticated SQL Injection

CVE-2026-9586
Verified

Description

Sangoma Switchvox before version 8.4.0.2 contains an unauthenticated SQL injection vulnerability in the /pa endpoint (PhoneAppsHandler.pm). The PhoneIP field extracted from an XML POST body is concatenated directly into an unparameterized PostgreSQL query that runs as a database superuser. An attacker can break out of the single-quoted SQL string context and leverage PostgreSQL COPY TO PROGRAM to execute arbitrary operating system commands without authentication.

Severity

Critical

CVSS Score

9.8

Exploit Probability

19%

Affected Product

switchvox

Published Date

September 1, 2026

Template Author

dhiyaneshdk

CVE-2026-9586.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-9586
CWE ID:
cwe-89

References

https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/https://nvd.nist.gov/vuln/detail/CVE-2026-9586

Remediation Steps

Upgrade Sangoma Switchvox to version 8.4.0.2 or later which parameterizes the SQL query and validates the PhoneIP input.