Critical SQL Injection in Sangoma Switchvox (CVE‑2026‑9586) Enables Remote Code Execution
What It Is – Sangoma Switchvox contains an unauthenticated SQL injection flaw that lets an attacker send a crafted HTTP request and run arbitrary SQL statements against the underlying PostgreSQL database. The flaw can be leveraged to execute remote code on the host.
Exploitability – The vulnerability is publicly disclosed (CVE‑2026‑9586) and a proof‑of‑concept request is available. No patch has been released at the time of writing. CVSS v3.1 scores it as 9.8 Critical.
Affected Products – Sangoma Switchvox (all supported versions prior to the vendor‑issued fix).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous application‑security controls (input validation, code review) that can be mapped to a single VCF control objective and thereby satisfy many frameworks (e.g., NIST CSF, ISO 27001).
- Lack of evidence that secure‑development practices are enforced can be a red flag for auditors demanding defensible control evidence.
- Continuous monitoring of vulnerability‑management processes provides the audit trail enterprises need to prove due diligence when a third‑party product is in scope.
Recommended Actions
- Patch immediately – Apply Sangoma’s security update as soon as it is released.
- Validate input handling – Conduct a code review or automated scan of all custom Switchvox integrations to confirm proper sanitization of database queries.
- Update vulnerability‑management controls – Record the finding in your risk register, map it to the “Application Security – Input Validation” control objective, and capture remediation evidence for audit purposes.
- Enhance continuous monitoring – Integrate the Switchvox asset into your security‑posture dashboard to flag future CVE disclosures automatically.
Source: CISA KEV – CVE‑2026‑9586