CVE-2026-9586

An unauthenticated remote attacker can execute arbitrary SQL statements and achieve remote code execution against Sangoma Switchvox via a SQL injection flaw.

Sangoma Switchvox contains a SQL injection vulnerability allowing unauthenticated remote attackers to execute arbitrary SQL statements against the backend PostgreSQL database, including remote code execution. This is a critical failure for DIB organizations because it enables remote code execution without authentication, leading to potential data breaches, system compromise, and compliance violations under NIST 800-171. Organizations must ensure all Sangoma Switchvox systems are patched immediately and monitor for exploitation attempts.

Shame score — The vulnerability allows unauthenticated remote code execution, which is a severe and avoidable failure that could lead to mass data breaches and system compromise.