CVE-2026-9586: Sangoma Switchvox SQL Injection Added to CISA KEV

TL;DR

CISA added CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox, to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a remediation due date of 2026-09-05. If you run Switchvox — especially internet-facing instances — inventory it today, apply the vendor's 8.4.0.2 release or documented mitigations, and verify the fix before closing your ticket.

What is this vulnerability?

• CVE: CVE-2026-9586
• Vendor / product: Sangoma / Switchvox (SMB Edition 8.3, build 104997)
• Vulnerability name: Sangoma Switchvox SQL Injection Vulnerability
• Weakness: CWE-89 (SQL Injection)
• CISA KEV status: Yes — added 2026-09-02
• CISA due date: 2026-09-05
• Known ransomware use: Unknown

The /pa endpoint processes XML content beginning with <PolycomIPPhone> and concatenates the user-controlled PhoneIP value directly into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database with a single crafted request, including database operations and remote code execution. Public proof-of-concept references exist, and EPSS places this CVE in the top ~4% of scored vulnerabilities.

KEV vs CVSS vs EPSS

Signal	What it measures	How to use it for this CVE
CISA KEV	Confirmed exploitation in the wild	Treat as an active threat. Federal agencies must remediate by 2026-09-05; all defenders should prioritize accordingly.
CVSS	Technical severity of the flaw	Scored 9.8 (CRITICAL) by NVD and 9.3 (CRITICAL) under CVSS 4.0 — network-reachable, no privileges, no user interaction.
EPSS	Probability of exploitation in the next 30 days	0.11845 (~95.9th percentile) — elevated likelihood, reinforcing KEV-driven urgency.

Step-by-step remediation

1. Inventory. Identify every Sangoma Switchvox instance in your estate, including SMB Edition 8.3 (104997) and any derived builds. Record owner, version, and internet exposure.
2. Patch or mitigate. Apply the vendor's fixed release (Switchvox 8.4.0.2, per the Sangoma release notes) or the mitigations documented by Sangoma. If mitigations are unavailable for a given deployment, follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product.
3. Reduce exposure. Where patching cannot be completed immediately, remove internet reachability from the /pa endpoint and restrict management interfaces to trusted networks.
4. Verify. Confirm the running version post-upgrade, re-test the endpoint from an external vantage point, and validate that the XML/PhoneIP input path is no longer reachable unauthenticated.
5. Hunt and triage. Review PostgreSQL and web logs for anomalous queries or requests to /pa with <PolycomIPPhone> payloads. Follow CISA's Forensics Triage Requirements for BOD 26-04 to scope potential compromise.
6. Close the ticket. Document version evidence, exposure changes, and log review results. Align closure criteria with BOD 26-04 Prioritizing Security Updates Based on Risk.

FAQ

Is CVE-2026-9586 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02.

What is the CISA due date? 2026-09-05. Federal civilian agencies must remediate by that date under BOD 26-04; other organizations should treat it as an urgent internal SLA.

Is this exploitable from the internet? The vulnerability is unauthenticated and network-reachable (CVSS 4.0 vector AV:N/PR:N/UI:N). Any internet-facing Switchvox instance should be considered at risk until patched or isolated.

Is there a ransomware tie? CISA lists known ransomware use as unknown for this CVE. Absence of a confirmed link does not lower priority — KEV status alone warrants immediate action.

Is there a public exploit? Yes. Public proof-of-concept references are available, which increases the likelihood of opportunistic scanning and exploitation.

What is the weakness class? CWE-89, SQL Injection. The /pa endpoint concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization.

Related resources

• Sangoma Switchvox Release Notes — Version 8.4.0.2
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2026-9586