SECURITYWEEK reports that Sangoma Switchvox has a critical unauthenticated SQL injection vulnerability, tracked as CVE-2026-9586, which enables remote code execution. The flaw exists in an endpoint that processes XML content and does not sanitise or parameterise the PhoneIP value when building PostgreSQL queries, allowing an unauthenticated attacker to run arbitrary SQL against the backend database and potentially execute remote code.
Evidence and response details cited in the piece include Horizon3’s disclosure that threat actors have begun exploiting CVE-2026-9586 in the wild, with indicators of compromise shared to aid intrusion detection. The US CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue, alongside several other issues, underscoring the high risk.
The article notes that the KEV listing situates this vulnerability among recently exploited flaws and highlights the urgency of remediation, though it does not specify a vendor patch timeline for Switchvox itself. Organisations using Switchvox should review for indicators associated with the CVE-2026-9586 exploitation pattern, apply available mitigations or patches promptly, and monitor for unusual PostgreSQL activity or remote command execution attempts as part of an informed response.