Vulnerability details

CVE-2026-9585

Sangoma Switchvox

Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal

CVSS 4.0

8.6High

Official description

An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid_browser and invalid_browser_login handlers. User-supplied data is reflected into JavaScript generated by the application, allowing attacker-controlled script execution within a victim's browser.

CVSS scores

Score	Version	Source	Vector
8.6High	4.0	CVEProject cvelistV5 (CNA) (SRA)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L`

Affected products

Vendor	Product	Versions	Source
Sangoma	Switchvox SMB Edition	8.3 (104997) ≤ v < 8.4.0.2	CVEProject cvelistV5 (CNA)

References and advisories

https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 release-notes
https://labs.sra.io/posts/switchvox/ third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-17
Last updated: 2026-07-17
State: Published
Assigner (CNA): SRA

Exploit prediction (EPSS)

0.55%

Probability of exploitation in 30 days

46.5%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-79
Improper neutralization of input during web page generation ('cross-site scripting')