PT-2026-60812 · Sangoma · Switchvox Smb Edition

Cam Lischke · CVE-2026-9588 · Published 2026-07-17 · Updated 2026-07-17

Mitre

CVSS v4.0

7.0

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:L

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit modify voicemail template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the template text parameter to be stored server-side and subsequently rendered to other users.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-9588

Affected Products

Switchvox Smb Edition

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-9588 · Security Note
• https://sangomakb.atlassian.net/wiki/spaces/Switchvox/pages/1802371073/Switchvox+-+Release+Notes+Version+8.4.0.2+July+14+2026 · Note
• https://labs.sra.io/posts/switchvox · Note