Skip to content
COOEY

FAIL › dossier

Switchvox

PRODUCT

· dossier confidence 0%

Sangoma Switchvox suffered a critical unauthenticated SQL injection vulnerability (CVE-2026-9586) that allowed remote code execution as a PostgreSQL superuser. The flaw was actively exploited by threat actors deploying reverse shells without credentials, highlighting severe gaps in vulnerability management and patching processes.

Failure events
2
Zero-days
0
RCEs
1
On KEV
1
Critical
1
Worst shame
85
PROFILE
CategoryVoIP/TelephonyWhat they doSangoma Switchvox is an enterprise VoIP platform providing unified communications and call management solutions.
SECURITY POSTURE

The security posture is critically compromised by a high-severity unauthenticated SQL injection vulnerability (CVE-2026-9586) that allowed remote code execution as a PostgreSQL superuser without credentials. The flaw was actively exploited in the wild by threat actors deploying reverse shells, indicating a severe lack of timely patching and secure default configurations.

Notable failures
  • CVE-2026-9586: Unauthenticated SQL injection leading to RCE as PostgreSQL superuser
  • Active exploitation of CVE-2026-9586 by threat actors deploying reverse shells without credentials
Patterns: Unpatched critical SQL injection vulnerabilities in core application components; Failure to patch high-severity flaws before active exploitation in the wild
FAILURE HISTORY · 2
DATEEVENTSEVSUMMARY
2026-09-02 CVE-2026-9586 high An unauthenticated remote attacker can execute arbitrary SQL statements and achieve remote code execution against Sangoma Switchvox via a SQL injection flaw.
2026-07-17 CVE-2026-9586 critical CVE-2026-9586: An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB E
DOSSIER SOURCES
Open questions: Who owns Sangoma Switchvox? · What is the headquarters location of Sangoma Switchvox? · When was Sangoma Switchvox founded? · What is the size of Sangoma Switchvox? · What is the official website of Sangoma Switchvox?
DOSSIER · dex-RAG synthesis · grounded in our own collection + trusted sourcesbuilt 2026-09-03 03:53:01.316500+00:00