PT-2026-60812 · Sangoma · Switchvox Smb Edition

Cam Lischke · CVE-2026-9588 · Publicado 2026-07-17 · Atualizado 2026-07-17

Mitre

CVSS v4.0

7.0

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:L

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit modify voicemail template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the template text parameter to be stored server-side and subsequently rendered to other users.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-9588

Produtos afetados

Switchvox Smb Edition

Referências · 3

• https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9588 · Nota de Segurança
• https://labs.sra.io/posts/switchvox · Nota