Is CVE-2026-45362 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45362 being exploited in the wild.

How severe is CVE-2026-45362?

Low severity, with a CVSS score of 3.2, published 12 May 2026.

Is there a fix for CVE-2026-45362?

A patch was published on 2026-05-12: Remediation released in version 8.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45362 attacked?

It is attacked with local access, in a network appliance.

Am I affected by CVE-2026-45362?

Check whether you run Sangoma Switchvox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45362: Sangoma Switchvox cleartext SIP credentials in backup file

CVE-2026-45362 · Severity: low · CVSS 3.2 · Published 2026-05-12

Sangoma Switchvox, a business phone system (PBX), was found to store sensitive phone service credentials in unencrypted plain text within its system backup files. If an unauthorized person gains access to one of these backup files, they could steal the credentials used to connect the phone system to the external carrier. This could allow an attacker to make fraudulent long-distance calls, intercept incoming business calls, or spoof the company's caller ID, potentially leading to financial loss and reputational damage.

Vendors: Sangoma.

Quick answers

Is CVE-2026-45362 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45362 being exploited in the wild.
How severe is CVE-2026-45362?: Low severity, with a CVSS score of 3.2, published 12 May 2026.
Which products and versions are affected?: Sangoma Switchvox before 8.4.
Is there a fix for CVE-2026-45362?: A patch was published on 2026-05-12: Remediation released in version 8.4 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45362 attacked?: It is attacked with local access, in a network appliance.
Am I affected by CVE-2026-45362?: Check whether you run Sangoma Switchvox at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Sangoma Switchvox prior to version 8.4 suffers from a cleartext storage vulnerability (CWE-312) within its proprietary .svb backup format. The backup files contain SIP trunk authentication usernames, passwords, carrier hostnames, and DID assignments without encryption or obfuscation. While the CVSS 3.1 score is rated as Low (3.2) due to the local access requirement to obtain the backup file, the impact of credential extraction is significant. An attacker with access to a backup file can extract these details to register directly with the upstream SIP carrier, enabling toll fraud, inbound call interception, and caller ID spoofing. This issue was remediated in Switchvox version 8.4.

Affected products

Sangoma Switchvox before 8.4

Timeline

2026-05-11: disclosed: Coordinated disclosure initiated and CVE assigned
2026-05-12: advisory: NVD publication date
2026-05-12: patched: Remediation released in version 8.4

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.