Which versions of Sangoma Switchvox are affected by CVE-2026-9588?

Sangoma Switchvox SMB Edition 8.3 contains a stored cross-site scripting vulnerability in voicemail templates that could enable authenticated users to inject malicious code affecting all organization…. A patch is available.

How to fix or mitigate CVE-2026-9588?

Within 24 hours, inventory all Sangoma Switchvox SMB Edition 8.3 (build 104997) installations and immediately restrict administrative access to the voicemail template modification feature; audit existing templates and user access logs for suspicious modifications. Within 7 days, implement Web Application Firewall rules to block HTML and JavaScript injection via the template_text parameter, or disable voicemail notification templates if operationally feasible; restrict template changes to a single administrator with session logging. Within 30 days, contact Sangoma support to confirm patch availability timeline; if no patch is available, evaluate upgrading to Switchvox 8.4+ or migration to alternative systems; if remaining on 8.3, establish compensating controls as permanent measures.

Sangoma Switchvox CVE-2026-9588

Q: What is the CVSS score of CVE-2026-9588?

CVE-2026-9588 has a CVSS 4.0 base score of 7.0 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-45207 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-17 SRA

GHSA-xrh4-q49w-whmw

XSS Switchvox Smb Edition Sangoma

7.0

CVSS 4.0 · Vendor: SRA

Severity by source

Vendor (SRA) PRIMARY

7.0 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Authenticated user injects stored payload (PR:L) that runs in another user's browser (UI:R, scope change S:C), yielding limited session-level confidentiality and integrity impact.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (SRA).

CVSS VectorVendor: SRA

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Scope

Lifecycle Timeline

Patch available

Jul 17, 2026 - 18:33 EUVD

Analysis Generated

Jul 17, 2026 - 16:47 vuln.today

CVE Published

Jul 17, 2026 - 15:59 cve.org

HIGH 7.0

DescriptionCVE.org

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the template_text parameter to be stored server-side and subsequently rendered to other users.

AnalysisAI

Stored cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an authenticated user inject persistent JavaScript through the voicemail notification template feature, which then executes in the browsers of other users who view the affected template. The payload is submitted via the template_text parameter to the submit_modify_voicemail_template endpoint, which fails to sanitize HTML. No public exploit identified at time of analysis, though the flaw was disclosed with a technical writeup by researchers at SRA; it is not listed in CISA KEV.

Technical ContextAI

Switchvox is Sangoma's IP PBX/unified-communications appliance; the SMB Edition targets small and medium businesses for voice, voicemail, and messaging. The vulnerability is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) stored/persistent XSS: the web administration interface's voicemail notification template accepts HTML/JavaScript in the template_text field and persists it server-side without output encoding or input sanitization. When another user (e.g., an administrator or a different extension owner) later renders that template, the stored markup is interpreted by their browser rather than displayed as inert text. The single affected CPE is cpe:2.3:a:sangoma:switchvox_smb_edition:*:*:*:*:*:*:*:*, with the vulnerable build identified as 8.3 (104997).

RemediationAI

Vendor-released patch: upgrade Switchvox SMB Edition to version 8.4.0.2 or later, per the July 14, 2026 release notes (https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026). Until the upgrade is applied, reduce exposure by restricting who can modify voicemail notification templates - limit administrative and template-editing privileges to trusted staff only, since exploitation requires an authenticated account; audit existing voicemail notification templates for unexpected HTML or <script> content and remove any injected markup. Additionally, restrict network access to the Switchvox web management interface to a management VLAN or VPN so account exposure is minimized; the trade-off is reduced convenience for remote administrators. These are compensating controls only and do not fully remove the flaw, which the 8.4.0.2 patch addresses. See the SRA advisory (https://labs.sra.io/posts/switchvox/) for details.