CVE-2026-9586: Sangoma Switchvox SQL Injection Flaw

CVE-2026-9586 Overview

CVE-2026-9586 is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (build 104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and concatenates the user-controlled PhoneIP value directly into PostgreSQL queries. The backend performs no sanitization or parameterization on the input. A remote attacker can issue a single crafted HTTP request to execute arbitrary SQL against the PostgreSQL database. Exploitation supports arbitrary database operations and can be chained to achieve remote code execution on the underlying host. The flaw is tracked under CWE-89.

Critical Impact
An unauthenticated remote attacker can execute arbitrary SQL against the Switchvox PostgreSQL backend and pivot to remote code execution on the appliance.

Affected Products

Sangoma Switchvox SMB Edition 8.3 (build 104997)
Switchvox versions prior to 8.4.0.2

Discovery Timeline

2026-07-14 - Sangoma releases Switchvox 8.4.0.2 addressing the issue
2026-07-17 - CVE-2026-9586 published to NVD
2026-07-17 - Last updated in NVD database

Technical Details for CVE-2026-9586

Vulnerability Analysis

The /pa endpoint on Switchvox SMB Edition accepts XML payloads intended for Polycom IP phone provisioning. When a request body begins with the <PolycomIPPhone> root element, the handler extracts the PhoneIP attribute or child value and passes it into a PostgreSQL query. The value is concatenated as a raw string literal rather than bound as a parameter. This allows an attacker to break out of the string context and append additional SQL statements or subqueries in a single request. Because the endpoint does not require authentication, exploitation requires only network reachability to the Switchvox web interface.

Root Cause

The root cause is the absence of parameterized queries or input validation on the PhoneIP field within the /pa XML handler. String concatenation into a PostgreSQL statement combined with an unauthenticated code path produces a direct injection primitive classified as CWE-89.

Attack Vector

Exploitation is performed over the network by sending a single HTTP POST request containing a crafted <PolycomIPPhone> XML document. The attacker embeds SQL syntax within the PhoneIP value to terminate the intended query and append arbitrary statements. PostgreSQL features such as COPY ... FROM PROGRAM or user-defined functions can be leveraged post-injection to escalate from database access to command execution on the host. See the SRA Labs advisory for the full exploitation walkthrough.

Detection Methods for CVE-2026-9586

Indicators of Compromise

HTTP POST requests to the /pa endpoint containing <PolycomIPPhone> XML with SQL metacharacters (single quotes, semicolons, --, UNION, SELECT) inside the PhoneIP field.
PostgreSQL log entries showing syntactically unusual queries originating from the Switchvox application user, especially statements referencing pg_read_server_files, COPY, or CREATE FUNCTION.
Outbound connections or new local processes spawned by the PostgreSQL service account following requests to /pa.

Detection Strategies

Inspect web server access logs for POST /pa requests with abnormally long or encoded PhoneIP values.
Enable PostgreSQL log_statement = 'all' on the Switchvox appliance temporarily and alert on statements not matching the expected provisioning pattern.
Monitor process trees for shells or interpreters spawned as child processes of the PostgreSQL or web server processes.

Monitoring Recommendations

Deploy a network IDS signature that inspects HTTP bodies posted to /pa for SQL injection tokens within <PolycomIPPhone> elements.
Baseline normal /pa traffic volume and source IPs, then alert on requests from IPs that are not registered Polycom endpoints.
Forward Switchvox web, PostgreSQL, and system logs to a central SIEM for correlation of injection attempts with follow-on host activity.

How to Mitigate CVE-2026-9586

Immediate Actions Required

Upgrade Switchvox SMB Edition to version 8.4.0.2 or later as documented in the Sangoma release notes.
Restrict network access to the Switchvox management and provisioning interfaces so only trusted VLANs and known phone subnets can reach /pa.
Review PostgreSQL and web logs for prior exploitation attempts and search the appliance for unauthorized accounts, cron jobs, or binaries.

Patch Information

Sangoma addressed the vulnerability in Switchvox 8.4.0.2, released on 2026-07-14. Administrators should apply the update through the standard Switchvox upgrade process. Full remediation details are provided in the vendor release notes.

Workarounds

Block external access to the /pa endpoint at the perimeter firewall or reverse proxy until the patch is applied.
Apply an ACL that limits HTTP access to the Switchvox web interface to a management jump host.
If phone provisioning must remain reachable, terminate connections at a reverse proxy that enforces strict XML schema validation and rejects PhoneIP values containing SQL metacharacters.

bash

# Example nginx snippet to restrict /pa to a trusted provisioning subnet
location /pa {
    allow 10.20.30.0/24;
    deny all;
    proxy_pass http://switchvox_backend;
}