CVE-2026-9585: Sangoma Switchvox SMB Edition XSS Flaw

CVE-2026-9585 Overview

CVE-2026-9585 is an unauthenticated reflected cross-site scripting (XSS) vulnerability in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to sanitize the portal parameter passed to the invalid_browser and invalid_browser_login handlers. Attacker-supplied data is reflected into JavaScript generated by the server, enabling arbitrary script execution in a victim's browser session. The flaw is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Attackers can execute arbitrary JavaScript in the context of a logged-in Switchvox administrator, enabling session theft, credential capture, and unauthorized PBX configuration changes.

Affected Products

Sangoma Switchvox SMB Edition version 8.3 (104997)
Switchvox invalid_browser handler
Switchvox invalid_browser_login handler

Discovery Timeline

2026-07-14 - Sangoma releases Switchvox version 8.4.0.2 addressing the flaw
2026-07-17 - CVE-2026-9585 published to the National Vulnerability Database (NVD)
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-9585

Vulnerability Analysis

The vulnerability resides in how the Switchvox web interface constructs client-side JavaScript from HTTP request parameters. When a user hits the invalid_browser or invalid_browser_login handler, the application takes the value of the portal parameter from the query string and inlines it directly into a JavaScript block returned to the browser.

Because the handler is reachable without authentication, an attacker only needs to deliver a crafted URL to a target. The reflected payload executes in the origin of the Switchvox management interface, granting the attacker access to session cookies, DOM content, and any privileged actions the victim can perform.

The issue impacts confidentiality and integrity of the PBX administration interface. Voice traffic and telephony services remain available, but attacker-controlled scripts can pivot to modify extensions, call routing, or exfiltrate credentials used to manage the appliance.

Root Cause

The root cause is missing output encoding on the portal request parameter before it is embedded inside a <script> context. HTML-encoding alone is insufficient inside JavaScript literals; the application must apply JavaScript string escaping or refuse non-allowlisted values. Neither control is applied in version 8.3 (104997).

Attack Vector

An attacker crafts a URL targeting the vulnerable handler with a portal value containing JavaScript-breaking characters. The attacker delivers the link through phishing, chat, or a compromised web page. When an authenticated Switchvox administrator visits the link, the malicious script executes in the administrator's browser under the Switchvox origin. User interaction is required, but no credentials are needed to trigger reflection. See the SRA Labs Blog Post for detailed reproduction steps.

Detection Methods for CVE-2026-9585

Indicators of Compromise

Web server access logs containing requests to /invalid_browser or /invalid_browser_login with unusual portal parameter values containing quotes, angle brackets, backticks, or script keywords.
Referrers pointing to external, untrusted domains for requests hitting the invalid browser handlers.
Administrator sessions initiating configuration changes shortly after visiting an externally referred URL.

Detection Strategies

Deploy a Web Application Firewall (WAF) rule that inspects the portal query parameter for characters such as <, >, ", ', and JavaScript keywords when directed at Switchvox handlers.
Enable Content Security Policy (CSP) reporting on the Switchvox interface to surface script-src violations indicative of injection attempts.
Correlate authentication events with immediately preceding invalid_browser* requests to identify potentially compromised admin sessions.

Monitoring Recommendations

Alert on any HTTP 200 responses from invalid_browser or invalid_browser_login endpoints where the request contains URL-encoded script tags or event handlers.
Monitor outbound traffic from administrator workstations to detect data exfiltration to attacker-controlled domains following browser interaction with Switchvox.
Review browser history and endpoint proxy logs for admin users to identify delivery vectors for crafted URLs.

How to Mitigate CVE-2026-9585

Immediate Actions Required

Upgrade Switchvox SMB Edition to version 8.4.0.2 or later per the Sangoma Release Notes.
Restrict access to the Switchvox management interface to trusted administrative networks using firewall rules or a VPN.
Instruct administrators to avoid clicking Switchvox links delivered through email, chat, or external websites until patching is complete.

Patch Information

Sangoma addressed CVE-2026-9585 in Switchvox version 8.4.0.2, released on July 14, 2026. The patch enforces proper encoding of the portal parameter within the invalid_browser and invalid_browser_login handlers. Administrators should apply the update through the standard Switchvox upgrade process and verify the running version after reboot.

Workarounds

Block external HTTP(S) access to the Switchvox web interface at the perimeter until the patch is applied.
Deploy a reverse proxy or WAF in front of Switchvox that strips or rejects requests containing suspicious portal parameter values.
Require administrators to use a dedicated, hardened browser profile with strict script controls when accessing the Switchvox console.

bash

# Example nginx rule to block suspicious portal parameter values
location ~ ^/(invalid_browser|invalid_browser_login) {
    if ($arg_portal ~* "(<|>|script|javascript:|onerror|onload)") {
        return 403;
    }
    proxy_pass https://switchvox.internal;
}