Is CVE-2026-9588 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9588 being exploited in the wild.

How severe is CVE-2026-9588?

Informational severity, with a CVSS score of 7, published 17 July 2026.

Which products and versions are affected?

Sangoma Switchvox SMB Edition 8.3 (104997) before 8.4.0.2.

Is there a fix for CVE-2026-9588?

A patch was published on 2026-07-14: Vendor releases version 8.4.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9588 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-9588?

Check whether you run Sangoma Switchvox SMB Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9588: Sangoma Switchvox SMB stored XSS in voicemail notification template

CVE-2026-9588 · Severity: info · CVSS 7 · Published 2026-07-17

Sangoma Switchvox is a business phone system used for managing corporate communications. A security flaw in the voicemail notification system allows an authorized user to inject malicious code into notification templates. If another user views these templates, the code could execute in their browser, potentially leading to unauthorized actions or data theft within the management portal.

Technologies: Sangoma Switchvox SMB Edition. Vendors: Sangoma.

Quick answers

Is CVE-2026-9588 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9588 being exploited in the wild.
How severe is CVE-2026-9588?: Informational severity, with a CVSS score of 7, published 17 July 2026.
Which products and versions are affected?: Sangoma Switchvox SMB Edition 8.3 (104997) before 8.4.0.2.
Is there a fix for CVE-2026-9588?: A patch was published on 2026-07-14: Vendor releases version 8.4.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9588 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-9588?: Check whether you run Sangoma Switchvox SMB Edition at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in the voicemail notification template functionality of Sangoma Switchvox SMB Edition. The 'submit_modify_voicemail_template' endpoint fails to properly sanitize HTML content provided in the 'template_text' parameter. An authenticated attacker can submit malicious JavaScript that is stored on the server and executed in the context of other users' browsers when they view the affected template. This vulnerability is fixed in version 8.4.0.2.

Affected products

Sangoma Switchvox SMB Edition 8.3 (104997) before 8.4.0.2

Timeline

2026-05-11: disclosed: SRA submits vulnerabilities to vendor
2026-06-02: other: Vendor acknowledges vulnerabilities
2026-07-14: patched: Vendor releases version 8.4.0.2
2026-07-17: advisory: SRA and NVD publish advisory details

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.