What is GHSA-m32j-v93f-gfgc?

GHSA-m32j-v93f-gfgc is a security advisory published by GitHub Security Advisories with Critical severity. An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...

Which CVE IDs does GHSA-m32j-v93f-gfgc cover?

GHSA-m32j-v93f-gfgc covers the following CVE IDs: CVE-2026-9586. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m32j-v93f-gfgc?

GHSA-m32j-v93f-gfgc has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-m32j-v93f-gfgcCriticalCVSS 9.8

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 ...

Vendor

GitHub Security Advisories

Published

July 17, 2026

Last Modified

September 2, 2026

🔗 CVE IDs covered (1)

CVE-2026-9586 →

📋 Description

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2026-9586
https://labs.sra.io/posts/switchvox
https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026
https://horizon3.ai/attack-research/disclosures/cve-2026-9586-sangoma-switchvox-rce/#
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-9586
https://github.com/advisories/GHSA-m32j-v93f-gfgc