Sangoma Switchvox SMB Vulnerability Advisory: XSS, SQLi, RCE, LFI (CVE-2026-9585 to 9588)

Vulnerability Overview SRA Labs discovered multiple vulnerabilities in Sangoma Switchvox SMB, which could lead to stored and reflected Cross-Site Scripting (XSS), SQL Injection (SQLi), Remote Code Execution (RCE), and Local File Inclusion (LFI). Affected Versions CVE-2026-9585: Unauthenticated reflected Cross-Site Scripting (XSS) in the Switchvox SMB Web Portal. CVE-2026-9586: Unauthenticated SQL injection leading to Remote Code Execution (RCE) in Switchvox SMB. CVE-2026-9587: Authenticated Local File Inclusion (LFI) in the Switchvox SMB Web Portal. CVE-2026-9588: Authenticated stored Cross-Site Scripting (XSS) in the Switchvox SMB Web Portal. Remediation Update Sangoma Switchvox SMB to version 8.4.0.2 or later. Vulnerability Details CVE-2026-9585: Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal Description: The application failed to properly sanitize portal parameters provided to the invalid browser and invalid browser login handlers. User-supplied data was reflected into JavaScript generated by the application, allowing attackers to execute controlled scripts in the victim's browser. Severity: CVSS Base Score 8.6 (High) CVE-2026-9586: Unauthenticated SQL Injection Leading to Remote Code Execution in Switchvox SMB Description: The endpoint processes XML content, directly concatenating user-controlled values into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements, including database operations and Remote Code Execution (RCE), using a single crafted request. Severity: CVSS Base Score 9.3 (Critical) CVE-2026-9587: Authenticated Local File Inclusion (LFI) in Switchvox SMB Web Portal Description: The feature accepts user-controlled input via the parameter and fails to properly validate the file path before accessing the underlying file system. By providing an absolute path, an authenticated attacker can retrieve files outside the intended directory scope. Severity: CVSS Base Score 7.1 (High) CVE-2026-9588: Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal Description: The endpoint failed to properly sanitize HTML content provided by authenticated users, allowing malicious JavaScript to be stored server-side via the parameter and subsequently rendered to other users. Severity: CVSS Base Score 7.0 (High) Affected Versions and Models Sangoma Switchvox SMB versions from 8.3 (104997) up to, but not including, 8.4.0.2. MITRE CWE Weakness Enumeration CVE-2026-9585: CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) CVE-2026-9586: CWE-89 SQL Injection CVE-2026-9587: CWE-73 External Control of File Name or Path CVE-2026-9588: CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Remediation Options Update Sangoma Switchvox SMB to version 8.4.0.2 or later. Source These vulnerabilities were discovered by Cameron Lischke as part of the research division at Security Risk Advisors (SRA). Timeline May 11-26, 2026: SRA submitted vulnerabilities to the vendor. June 2, 2026: Vendor acknowledged the disclosed vulnerabilities and intended to fix them. July 16, 2026: Vendor released the fix. July 17, 2026: SRA published the CVEs and recommendations.

Goal Reached Thanks to every supporter — we hit 100%!

Sangoma Switchvox SMB Vulnerability Advisory: XSS, SQLi, RCE, LFI (CVE-2026-9585 to 9588)