Security Advisory

Sangoma Product Security Update Advisory

  • Sep 03 2026
Sangoma Product Security Update Advisory

Overview

A security update has been released to address a vulnerability in Sangoma products. The affected product is Sangoma Switchvox SMB, and users should update to the latest version.

Affected Products

  • Sangoma Switchvox SMB.
  • Affected versions are 8.3 (104997) Through 8.4.0.2.
  • Fixed versions are 8.4.0.2 And later.

Identified Vulnerabilities

  • CVE-2026-9585: A pre-authentication reflected cross-site scripting (XSS; a vulnerability that allows malicious scripts to execute in the user’s browser) vulnerability occurring in the Sangoma Switchvox SMB web portal.
  • CVE-2026-9586: A remote code execution vulnerability caused by pre-authentication SQL injection (an attack that exploits database queries) in Sangoma Switchvox SMB.
  • CVE-2026-9587: This is a post-authentication local file inclusion (LFI; a vulnerability that allows reading local files on the server) vulnerability in the Sangoma Switchvox SMB web portal.
  • CVE-2026-9588: This is a post-authentication stored XSS vulnerability in the Sangoma Switchvox SMB web portal.

Mitigation

Vulnerability Patches have been released via the latest update. Follow the instructions on the reference site to update to Sangoma Switchvox SMB 8.4.0.2 Or later.

References

  • Advisory: Sangoma Switchvox SMB.
  • Https://labs.Sra.Io/posts/switchvox/

Tags:
Previous Post

Next Post