Sangoma Switchvox SQL Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 02/09/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| switchvox | ≥ 8.2.2.1, < 8.4.0.2 | 8.4.0.2 |
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free