Sangoma Switchvox CVE-2026-9586

No special authentication is required - the CVSS vector is PR:N/UI:N, confirming unauthenticated exploitation with no user interaction against Switchvox SMB Edition 8.3 (104997). The one concrete prerequisite from the description is network reachability to the /pa endpoint and the ability to submit an XML request body beginning with the <PolycomIPPhone> element, where the injectable value is the PhoneIP field parsed from that XML. What limits exploitation in practice is: the attacker must be able to reach /pa (appliances placed behind provisioning-only network segments or not exposed to the internet are far less exposed), and only the identified vulnerable version/build (8.3 / 104997 and earlier unpatched builds) is affected - 8.4.0.2 remediates it. No non-default feature toggle is described; the vulnerable code path appears reachable in a standard configuration.

This is a genuine high-priority issue rather than an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction and full confidentiality/integrity/availability impact on the vulnerable system - the least restrictive possible prerequisites - and the description's 'single crafted request' claim is consistent with that vector, so the signals do not conflict. No EPSS score was provided, so statistical exploitation probability cannot be quoted, and the CVE is not listed in CISA KEV, so there is no confirmed active exploitation. A detailed vendor writeup exists (SRA labs), which raises the practical likelihood that working exploit code will appear even though none is confirmed yet. The combination of unauthenticated network vector, trivial complexity, and SQLi-to-RCE impact means any internet-exposed or attacker-reachable Switchvox SMB 8.3 instance should be treated as urgently exploitable; the main limiter on real-world risk is deployment footprint and whether the /pa endpoint is network-exposed, not exploit difficulty.

An attacker who can reach the appliance's web interface sends a single unauthenticated HTTP request to /pa with an XML body starting <PolycomIPPhone> and a malicious PhoneIP value containing SQL, which is concatenated straight into a PostgreSQL query. With low attack complexity and no authentication or user interaction, the attacker dumps or modifies database contents and pivots the SQL access into command execution on the appliance. No public exploit code is confirmed, but the SRA labs writeup documents the vulnerable code path in detail.