CVE-2026-9586

Name of the Vulnerable Software and Affected Versions Sangoma Switchvox versions prior to 8.4.0.2

Description An unauthenticated SQL injection exists in the /pa endpoint, which processes XML content beginning with <PolycomIPPhone>. The issue occurs because the PhoneIP variable is concatenated directly into PostgreSQL queries without proper sanitization or parameterization. This allows a remote attacker to execute arbitrary SQL statements as a PostgreSQL superuser, which can be further leveraged to achieve remote code execution (RCE) on the underlying operating system. Real-world exploitation has been observed, including the deployment of reverse shells and post-exploitation reconnaissance such as process enumeration. Approximately 4,000 Switchvox systems are estimated to be exposed to the internet, primarily in the United States.

Recommendations Upgrade to version 8.4.0.2 or later. Restrict access to the /pa endpoint and the web management interface to trusted IP addresses only to minimize internet exposure. Inspect /var/log/switchvox/db-quirks.log for unexpected SQL activity and command-execution artifacts.