[CRITICAL] – Sangoma Switchvox RCE Added to CISA KEV After Active Exploitation

Key Facts

Horizon3 reported active exploitation of CVE-2026-9586 in Sangoma Switchvox. The NVD record describes an unauthenticated SQL-injection flaw with a 9.3 CVSS score.

Technical Details

According to SecurityWeek’s report on the vendor and research disclosures, the vulnerable endpoint processes XML content and allows attacker-controlled input to reach PostgreSQL queries; the issue can lead to arbitrary code execution.

Impact & Mitigation

CISA added CVE-2026-9586 to its Known Exploited Vulnerabilities Catalog. Apply Sangoma’s available remediation, restrict management exposure, and investigate using the published indicators.

Sources

• Horizon3 research
• NVD CVE record
• CISA KEV Catalog