Switchvox SMB Edition vulnerabilities

4 known vulnerabilities in Switchvox SMB Edition from Sangoma. 4 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.0 High severity

  Switchvox SMB Edition: Improper Neutralization of Input During Web Page Generation

  CVE-2026-9588Jul 17, 2026Sangoma

  A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by a

• 7.1 High severity

  Switchvox SMB Edition: External Control of File Name or Path

  CVE-2026-9587Jul 17, 2026Sangoma

  An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the

• 9.8 Critical severity

  Sangoma Switchvox SQL Injection Exploited

  CVE-2026-9586Jul 17, 2026SangomaEPSS 19%

  An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries with

• 8.6 High severity

  Switchvox SMB Edition: Improper Neutralization of Input During Web Page Generation

  CVE-2026-9585Jul 17, 2026Sangoma

  An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_login handle