CVE-2026-9586: Sangoma Switchvox SQL Injection Added to CISA KEV

TL;DR

CISA added CVE-2026-9586, an unauthenticated SQL injection in Sangoma Switchvox, to the Known Exploited Vulnerabilities catalog on 2026-09-02 with a remediation due date of 2026-09-05. If you run Switchvox — especially internet-facing instances — inventory it today, apply the vendor's 8.4.0.2 release or documented mitigations, and verify the fix before closing your ticket. The flaw is network-reachable with no privileges and no user interaction, and public proof-of-concept references exist, so opportunistic scanning is likely.

What this is

CVE-2026-9586 is a SQL injection (CWE-89) in Sangoma Switchvox, specifically SMB Edition 8.3, build 104997, and any derived builds. The affected component is the /pa endpoint, which processes XML content beginning with <PolycomIPPhone> and concatenates the user-controlled PhoneIP value directly into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database with a single crafted request, including database operations and remote code execution. NVD scores it 9.8 (CRITICAL) and CVSS 4.0 scores it 9.3 (CRITICAL), reflecting a network-reachable flaw requiring no privileges and no user interaction. CISA added it to the KEV catalog on 2026-09-02, with a due date of 2026-09-05. Known ransomware use is listed as unknown. EPSS places this CVE in the top roughly 4% of scored vulnerabilities, at 0.11845 (about the 95.9th percentile).

Why it matters

KEV status means confirmed exploitation in the wild, not a theoretical risk. Federal civilian agencies must remediate by 2026-09-05 under BOD 26-04; every other organization should treat that date as an urgent internal SLA. The combination of unauthenticated access, network reachability, and a public proof of concept lowers the bar for opportunistic attackers, and the impact reaches the backend PostgreSQL database, where arbitrary SQL execution can extend to remote code execution. The elevated EPSS score reinforces the KEV-driven urgency rather than softening it. Absence of a confirmed ransomware link does not lower priority.

How it works

The /pa endpoint accepts XML content beginning with <PolycomIPPhone>. The user-controlled PhoneIP value from that XML is concatenated directly into PostgreSQL queries without sanitization or parameterization. Because the endpoint is unauthenticated and network-reachable, a single crafted request is enough to execute arbitrary SQL statements against the backend database, including database operations and remote code execution. The affected version stated in the original is SMB Edition 8.3, build 104997, along with derived builds; the fixed release is Switchvox 8.4.0.2 per the Sangoma release notes.

Detection and response

Hypothesis: an internet-facing Switchvox instance is running an affected build and its /pa endpoint is reachable unauthenticated. Evidence that confirms or rejects it: the running version (SMB Edition 8.3, build 104997 or a derived build versus 8.4.0.2), external reachability of /pa, and PostgreSQL and web logs showing anomalous queries or requests to /pa carrying <PolycomIPPhone> payloads. An advisory match against CVE-2026-9586 in the KEV catalog, plus the NVD entry and Sangoma release notes, anchors the finding.

What to do

1. Inventory. Identify every Sangoma Switchvox instance in your estate, including SMB Edition 8.3 (104997) and any derived builds. Record owner, version, and internet exposure.
2. Patch or mitigate. Apply the vendor's fixed release (Switchvox 8.4.0.2, per the Sangoma release notes) or the mitigations documented by Sangoma. If mitigations are unavailable for a given deployment, follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product.
3. Reduce exposure. Where patching cannot be completed immediately, remove internet reachability from the /pa endpoint and restrict management interfaces to trusted networks.
4. Verify. Confirm the running version post-upgrade, re-test the endpoint from an external vantage point, and validate that the XML/PhoneIP input path is no longer reachable unauthenticated.
5. Hunt and triage. Review PostgreSQL and web logs for anomalous queries or requests to /pa with <PolycomIPPhone> payloads. Follow CISA's Forensics Triage Requirements for BOD 26-04 to scope potential compromise.
6. Close the ticket. Document version evidence, exposure changes, and log review results. Align closure criteria with BOD 26-04 Prioritizing Security Updates Based on Risk.

FAQ

Is CVE-2026-9586 in CISA KEV? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-02.

What is the CISA due date? 2026-09-05. Federal civilian agencies must remediate by that date under BOD 26-04; other organizations should treat it as an urgent internal SLA.

Is this exploitable from the internet? The vulnerability is unauthenticated and network-reachable (CVSS 4.0 vector AV:N/PR:N/UI:N). Any internet-facing Switchvox instance should be considered at risk until patched or isolated.

Is there a ransomware tie? CISA lists known ransomware use as unknown for this CVE. Absence of a confirmed link does not lower priority — KEV status alone warrants immediate action.

Is there a public exploit? Yes. Public proof-of-concept references are available, which increases the likelihood of opportunistic scanning and exploitation.

What is the weakness class? CWE-89, SQL Injection. The /pa endpoint concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization.

Which versions are affected and which release fixes it? SMB Edition 8.3, build 104997, and derived builds are affected. The fixed release is Switchvox 8.4.0.2, per the Sangoma release notes.

Sources

• Sangoma Switchvox Release Notes — Version 8.4.0.2
• CISA BOD 26-04: Prioritizing Security Updates Based on Risk
• CISA BOD 26-04 Implementation Guidance — Forensics Triage Requirements
• NVD — CVE-2026-9586