PT-2026-60809 · Sangoma · Switchvox Smb Edition

Cam Lischke · CVE-2026-9585 · Published 2026-07-17 · Updated 2026-07-17

Mitre

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:L

An unauthenticated reflected cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 (104997). The application fails to properly sanitize the portal parameter supplied to the invalid browser and invalid browser login handlers. User-supplied data is reflected into JavaScript generated by the application, allowing attacker-controlled script execution within a victim's browser.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9585

Affected Products

Switchvox Smb Edition

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9585 · Security Note
• https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 · Note
• https://labs.sra.io/posts/switchvox · Note