First published 9/27/2026, 5:42:15 AM · Last updated 9/27/2026, 5:42:15 AM

CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability

An SQL injection in Sangoma Switchvox allows an unauthenticated remote attacker to execute arbitrary SQL statements and potentially achieve remote code execution against the backend PostgreSQL database. CISA advises applying vendor mitigations, following BOD 26-04 guidance for prioritizing updates and forensics, evaluating internet exposure, or discontinuing the product if mitigations are unavailable.

Categories: technology

Generated scores

Scores are based on the cited reporting and use a 1–10 scale. Read the methodology.

Confidence: 9/10How certain the assessment is based on the clarity and evidence in the cited reporting.
Geographic reach: 2/10How widely the event reaches, from a local area (1) to worldwide impact (10).
Global importance: 2/10The event's broader significance, from limited importance (1) to major global importance (10).
Impact magnitude: 6/10The scale or severity of the real-world impact, from minor (1) to extreme (10).
Positivity: 2/10How harmful or beneficial the event is, from strongly harmful (1) to strongly positive (10).
Urgency: 6/10How time-sensitive the event is, from low urgency (1) to immediate attention needed (10).

Why it matters

Exploitation can lead to database compromise and remote code execution on affected systems, creating significant security and operational risk.

Location

Sources

CVE-2026-9586: Sangoma Switchvox SQL Injection Vulnerability

Report an issue