SQL Injection Flaw in Sangoma Switchvox

Security researchers have identified a critical vulnerability within Sangoma Switchvox SMB Edition that allows for unauthenticated SQL injection. The flaw, tracked as CVE-2026-9586, presents a security risk by potentially allowing attackers to execute arbitrary SQL statements on the backend database.

Vulnerability in the /pa Endpoint

The issue resides in the way the /pa endpoint handles incoming data. According to the advisory, the system processes XML content that begins with the specific tag <PolycomIPPhone>. Within this process, the application takes the user-controlled PhoneIP value and performs direct concatenation into PostgreSQL queries.

Because the application fails to utilize proper sanitization or parameterization during this concatenation, the input remains vulnerable. An attacker can leverage this oversight by sending a single, crafted request to the endpoint, which is then executed by the system's database.

Potential for Database Manipulation

The impact of this flaw is significant due to the nature of the database operations permitted by the injection. By successfully sending a crafted request to the affected Switchvox installation, an unauthenticated remote attacker is able to execute arbitrary statements against the PostgreSQL backend.

The advisory highlights that these malicious requests are not limited to standard queries but can include a range of database operations and, ultimately, remote code execution. Because the vulnerability is unauthenticated, it does not require an attacker to have prior access to the system to initiate the exploit.

• Advisory ID: GHSA-m32j-v93f-gfgc
• Affected version: Sangoma Switchvox SMB Edition 8.3 (104997)
• Severity: critical

Why This Matters

The discovery of this vulnerability in Sangoma Switchvox SMB Edition 8.3 underscores the risks associated with improper handling of user-supplied data in backend queries. Because the system concatenates the PhoneIP value directly, it creates a pathway for unauthorized interaction with the underlying database. The ability to perform remote code execution via a single request indicates that the integrity of the PostgreSQL database and the associated server could be compromised. Understanding that this SQL injection vulnerability is accessible without authentication could mean that any exposure of the affected endpoint provides a direct vector for an attacker to reach the backend services.