CVE-2026-9586 is an unauthenticated SQL injection vulnerability in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content starting with <PolycomIPPhone> and uses the PhoneIP value directly in PostgreSQL queries without sanitization or parameterization. This flaw enables remote attackers to execute arbitrary SQL statements, including database operations and potentially remote code execution, without authentication. The vulnerability has a CVSS 4.0 score of 9.3, indicating critical severity. No patch or official remediation has been confirmed as of the published date.

An unauthenticated remote attacker can exploit this vulnerability to execute arbitrary SQL commands on the backend PostgreSQL database. This can lead to unauthorized data access, modification, deletion, and potentially remote code execution on the affected system. The critical CVSS score reflects the high impact and ease of exploitation without any required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /pa endpoint and monitor for suspicious activity. Avoid exposing the vulnerable service to untrusted networks. Do not rely on generic mitigations; wait for vendor guidance or patches.