Two critical vulnerabilities affecting business infrastructure have been added to CISA’s Known Exploited Vulnerabilities catalogue, with confirmed active exploitation in the wild. CVE-2026-9586 in Sangoma Switchvox allows unauthenticated remote code execution via SQL injection, affecting approximately 4,000 internet-facing instances. Meanwhile, SonicWall’s SMA1000 remote access gateways are vulnerable to an attack chain combining CVE-2026-83548, a CVSS 10.0 server-side request forgery flaw, with CVE-2026-83549, an OS command injection vulnerability. Both products are common in UK small business environments, and patches are available for all three CVEs. This episode examines the technical mechanisms behind these vulnerabilities, explains why internet-facing infrastructure requires emergency patching outside scheduled maintenance windows, and provides four concrete actions for business owners to verify their systems are protected. The NCSC’s vulnerability management guidance and GDPR Article 32 obligations are discussed in the context of patch management responsibilities.
