PT-2026-60809 · Sangoma · Switchvox Smb Edition

Cam Lischke · CVE-2026-9585 · Publicado 2026-07-17 · Atualizado 2026-07-17

Mitre

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L

An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid browser and invalid browser login handlers. User-supplied data is reflected into JavaScript generated by the application, allowing attacker-controlled script execution within a victim's browser.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-9585

Produtos afetados

Switchvox Smb Edition

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9585 · Nota de Segurança
• https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 · Nota
• https://labs.sra.io/posts/switchvox · Nota