Sangoma Switchvox
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Sangoma Switchvox.
By the Year
In 2026 there have been 5 vulnerabilities in Sangoma Switchvox with an average score of 6.3 out of ten. Switchvox did not have any published security vulnerabilities last year. That is, 5 more vulnerabilities have already been reported in 2026 as compared to last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 5 | 6.25 |
| 2025 | 0 | 0.00 |
| 2024 | 0 | 0.00 |
| 2023 | 0 | 0.00 |
| 2022 | 1 | 5.30 |
It may take a day or so for new Switchvox vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Sangoma Switchvox Security Vulnerabilities
XSS in Sangoma Switchvox SMB 8.3 Voicemail Template (submit_modify_voicemail_template)
CVE-2026-9588
- July 17, 2026
A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the template_text parameter to be stored server-side and subsequently rendered to other users.
XSS
Switchvox SMB Edition 8.3 LFI via sound_path (pre-8.3.1) - CVE-2026-9587
CVE-2026-9587
- July 17, 2026
An authenticated local file inclusion vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The play_file functionality accepts user-controlled input through the sound_path parameter and fails to properly validate file paths before accessing the underlying filesystem. By supplying absolute paths, an authenticated attacker can retrieve files outside the intended directory scope.
External Control of File Name or Path
Unauthenticated SQLi in Sangoma Switchvox SMB 8.3 /pa endpoint
CVE-2026-9586
9.3 - Critical
- July 17, 2026
An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.
SQL Injection
Unauthenticated Reflected XSS in Switchvox SMB 8.3 via portal param
CVE-2026-9585
- July 17, 2026
An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_login handlers. User-supplied data is reflected into JavaScript generated by the application, allowing attacker-controlled script execution within a victim's browser.
XSS
Sangoma Switchvox <8.4 leaks SIP creds in backup file
CVE-2026-45362
3.2 - Low
- May 12, 2026
Sangoma Switchvox before 8.4 places cleartext SIP authentication credentials in a backup file.
Cleartext Storage of Sensitive Information
Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction
CVE-2021-45310
5.3 - Medium
- February 14, 2022
Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted by sending an unauthenticated HTTP GET request to the https://Switchvox-IP/main?cmd=invalid_browser.
Information Disclosure
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Sangoma Switchvox or by Sangoma? Click the Watch button to subscribe.
