Which versions of Sangoma Switchvox are affected by CVE-2026-9585?

Sangoma Switchvox SMB Edition 8.3 contains a reflected cross-site scripting vulnerability allowing unauthenticated attackers to inject arbitrary JavaScript into users' browsers, potentially enabling…. A patch is available.

How to fix or mitigate CVE-2026-9585?

Within 24 hours, inventory all Sangoma Switchvox SMB Edition 8.3 (build 104997) instances and immediately notify users to avoid links containing 'portal' parameters from untrusted sources; enable strict Content Security Policy headers on all endpoints. Within 7 days, implement Web Application Firewall rules to block abnormal 'portal' parameter values and enable comprehensive logging for reflected XSS attempts against invalid_browser and invalid_browser_login handlers. Within 30 days, contact Sangoma for patch availability and timeline; plan upgrade to patched Switchvox release; establish 24/7 SIEM monitoring for CVE-2026-9585 exploitation attempts.

Sangoma Switchvox CVE-2026-9585

Q: What is the CVSS score of CVE-2026-9585?

CVE-2026-9585 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-45203 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-17 SRA

GHSA-34c9-mcf5-3rp3

XSS Switchvox Smb Edition Sangoma

8.6

CVSS 4.0 · Vendor: SRA

Severity by source

Vendor (SRA) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Unauthenticated network reflected XSS requiring a victim click (UI:R), running in the browser with scope change (S:C) and limited confidentiality/integrity impact; no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (SRA).

CVSS VectorVendor: SRA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 18:33 EUVD

Analysis Generated

Jul 17, 2026 - 16:45 vuln.today

CVE Published

Jul 17, 2026 - 15:56 cve.org

HIGH 8.6

DescriptionCVE.org

An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_login handlers. User-supplied data is reflected into JavaScript generated by the application, allowing attacker-controlled script execution within a victim's browser.

AnalysisAI

Reflected cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an unauthenticated remote attacker execute arbitrary JavaScript in a victim's browser by luring them to a crafted link. The flaw stems from the application reflecting an unsanitized 'portal' parameter into JavaScript emitted by the invalid_browser and invalid_browser_login handlers. No public exploit is identified at time of analysis, though the reporting researcher (SRA) has published a technical writeup, and no evidence of active exploitation exists.

Technical ContextAI

Switchvox is Sangoma's unified-communications (VoIP/PBX) appliance line; the SMB Edition targets small-and-medium business telephony deployments and exposes a web administration/user portal. The vulnerability is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS: the 'portal' request parameter is passed to the invalid_browser and invalid_browser_login handlers and reflected directly into dynamically generated JavaScript rather than HTML body text. Because the injection lands inside a JavaScript context, standard HTML-entity encoding would be insufficient and the attacker can break out of the intended string/statement to run script. The affected CPE is cpe:2.3:a:sangoma:switchvox_smb_edition:*:*:*:*:*:*:*:*, with the confirmed vulnerable build being version 8.3 (104997).

RemediationAI

Vendor-released patch: upgrade to Switchvox SMB Edition 8.4.0.2 (released July 14, 2026), per the release notes at https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026. If immediate upgrade is not possible, restrict network exposure of the Switchvox web portal so the invalid_browser and invalid_browser_login endpoints are not reachable from untrusted networks (e.g., place the management/user portal behind a VPN or IP allowlist), which reduces the pool of potential victims but may inconvenience remote users. A web application firewall rule that blocks or sanitizes 'portal' parameter values containing script-context-breaking characters on those handlers can serve as a stopgap, with the trade-off of possible false positives and being bypassable if the encoding is imperfect. Additionally, briefing users not to follow untrusted links to the Switchvox portal lowers the social-engineering success rate. Review the researcher writeup at https://labs.sra.io/posts/switchvox/ for exact parameter details when tuning any interim control.