CVE-2026-9588CWE-79

Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal

High · published July 17, 2026

CVSS v4.0
7.0
EPSS
0%
Percentile
33.6
In the wild
Unconfirmed
What it is

A stored cross-site scripting (XSS) vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997) within the voicemail notification template functionality. The submit_modify_voicemail_template endpoint fails to properly sanitize HTML content supplied by authenticated users, allowing malicious JavaScript supplied through the template_text parameter to be stored server-side and subsequently rendered to other users.

The record
Technical detail
CVSS v4.0
7.0 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:H/VA:N/SC:L/SI:L/SA:L
EPSS
0.00405 · 33.6th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-17T15:59Z
EPSS history
Timeline
  • 17 JUL 15:59Z
    Authenticated Stored Cross-Site Scripting (XSS) in Switchvox SMB Web Portal
    cvelistv5