Critical SQL Injection Hits Sangoma Switchvox

A critical, unauthenticated SQL injection vulnerability has been identified in Sangoma Switchvox SMB Edition 8.3 (104997), tracked as CVE-2026-9586. This flaw allows remote, unauthenticated attackers to execute arbitrary SQL statements against the backend PostgreSQL database, potentially leading to full system compromise.

What's at Risk

The vulnerability specifically affects the Sangoma Switchvox SMB Edition, version 8.3. Organizations utilizing this telephony platform are at significant risk, particularly if the management interface or the affected /pa endpoint is exposed to the public internet.

Because this flaw does not require authentication, any internet-facing deployment is essentially an open target. Such systems are often critical infrastructure for internal communications, making them high-value targets for threat actors seeking to gain a foothold in corporate networks or disrupt business operations.

How the Flaw Works

The issue stems from a failure to properly sanitize user-supplied input before incorporating it into database queries. In general, SQL injection (SQLi) occurs when an application takes untrusted data—such as parameters from an XML request—and concatenates that data directly into a query string. This allows an attacker to manipulate the structure of the SQL command.

By injecting malicious SQL syntax, an attacker can trick the database into executing unintended operations. Depending on the database configuration and permissions, this can lead to the unauthorized disclosure of sensitive data, the modification or deletion of records, and in many cases, remote code execution (RCE). Because the database often runs with elevated privileges, the impact of a successful injection can frequently escalate to total control over the underlying server.

How to Protect Your Systems

• Immediately apply the vendor-provided security patches for Sangoma Switchvox SMB Edition to address CVE-2026-9586.
• Restrict access to the /pa endpoint and administrative interfaces by enforcing strict IP whitelisting via firewall rules.
• Ensure that all internet-facing applications are placed behind a Web Application Firewall (WAF) configured to detect and block common SQL injection patterns.
• Implement network segmentation to isolate telephony infrastructure from critical internal servers to minimize the impact of a potential breach.
• Regularly audit system logs for suspicious XML requests or unusual database query activity that could indicate an exploitation attempt.

Given the critical severity of this vulnerability and the ease with which an unauthenticated attacker can exploit it, organizations must prioritize patching immediately. Failure to address this flaw leaves your communication infrastructure exposed to full database compromise and potential remote code execution by any remote actor on the internet.