Sangoma Switchvox SMB Edition Unauthenticated Remote Code Execution and SQL Injection Vulnerability Advisory (CVE-2026-9586)

1. Apply Official Security Patch

Immediately upgrade to the patched version released by the vendor.

• Target Version: Switchvox 8.4.0.2 or later
• Procedure: Access the Switchvox Admin Web Suite, navigate to Server > Updates, and apply the latest available release.

2. Temporary Mitigations (If patching cannot be applied immediately)

• Network Access Control: Restrict external access to the Switchvox administration interface and the /pa endpoint using firewalls or security groups. Only allow access from trusted internal networks or via VPN.
• WAF (Web Application Firewall) Rules: Deploy WAF signatures to inspect and block malicious XML payloads targeting the /pa endpoint, specifically looking for SQL syntax characters (', --, ;) within the PhoneIP XML element.

  # Example Nginx mitigation block (for reference)
  location /pa {
      limit_except GET {
          allow 10.0.0.0/8;
          deny all;
      }
  }

A critical SQL injection vulnerability (CVE-2026-9586) has been identified in the /pa endpoint of Sangoma Switchvox SMB Edition. This vulnerability stems from improper input sanitization and lack of query parameterization (CWE-89).

Vulnerability Mechanics

• Input Handling Flaw: The /pa endpoint processes incoming XML content. During this process, the user-controlled PhoneIP value is directly concatenated into PostgreSQL queries without sanitization or parameterization.
• Authentication Bypass: An attacker does not require any active session or credentials to access this endpoint, allowing unauthenticated remote exploitation.
• RCE Chain: By leveraging PostgreSQL database capabilities, an attacker can execute arbitrary SQL statements. This can be escalated to Remote Code Execution (RCE) on the underlying operating system using techniques such as COPY ... FROM PROGRAM or loading malicious shared libraries.

This vulnerability is actively exploited in the wild (CISA KEV listed) and carries an extremely high EPSS score of 0.94, indicating imminent threat.