Sangoma Switchvox and SonicWall SMA1000: CISA Confirms Active Exploits

Two critical vulnerabilities affecting business infrastructure have been added to CISA’s Known Exploited Vulnerabilities catalogue, with confirmed active exploitation in the wild. CVE-2026-9586 in Sangoma Switchvox allows unauthenticated remote code execution via SQL injection, affecting approximately 4,000 internet-facing instances. Meanwhile, SonicWall’s SMA1000 remote access gateways are vulnerable to an attack chain combining CVE-2026-83548, a CVSS 10.0 server-side request forgery flaw, with CVE-2026-83549, an OS command injection vulnerability. Both products are common in UK small business environments, and patches are available for all three CVEs. This episode examines the technical mechanisms behind these vulnerabilities, explains why internet-facing infrastructure requires emergency patching outside scheduled maintenance windows, and provides four concrete actions for business owners to verify their systems are protected. The NCSC’s vulnerability management guidance and GDPR Article 32 obligations are discussed in the context of patch management responsibilities.

Chapters

• Intro Corrine introduces two actively exploited vulnerabilities affecting common UK small business infrastructure: phone systems and remote access gateways. CISA added all three CVEs to its Known Exploited Vulnerabilities catalogue on 2 September 2026, confirming real-world exploitation.
• Your Phone System Is an Open Door CVE-2026-9586 in Sangoma Switchvox allows unauthenticated remote code execution via SQL injection. Approximately 4,000 instances are internet-facing. The vulnerability enables attackers to establish reverse shells, bypassing inbound firewall rules and gaining command-line access without credentials. Patches are available but remain unapplied in many cases.
• CTA Audience call to action: follow, rate, review, and share the show with others who manage small business IT.
• The VPN Gateway With a Perfect Vulnerability Score SonicWall SMA1000 appliances are affected by two vulnerabilities forming an attack chain. CVE-2026-83548, a CVSS 10.0 server-side request forgery flaw, requires no authentication. CVE-2026-83549 enables OS command injection with administrator credentials. Together, they allow complete remote compromise of devices designed to protect network perimeters. SonicWall appliances have been used in previous ransomware campaigns.
• The Pattern the Data Confirms Analysis of the common structure: both vulnerabilities affect infrastructure requiring manual patching, both allow unauthenticated exploitation, and both have available patches that predate active exploitation. The NCSC’s vulnerability management guidance requires prioritising internet-facing systems, and Cyber Essentials certification mandates patching high-risk vulnerabilities within 14 days.
• Making the Business Case Three arguments for emergency patching: cost asymmetry between patching and breach response, GDPR Article 32 obligations under ICO oversight, and MSP contractual responsibilities for critical infrastructure security. Failing to patch known critical vulnerabilities is difficult to defend during breach investigations.
• What to Do Before Friday Four concrete actions: identify whether you run affected products, confirm patch status in writing with version numbers, take unpatched devices offline if patching cannot be confirmed, and review patch management SLAs with IT providers to establish defined processes for critical vulnerabilities.
• Outro Corrine summarises: vulnerabilities are confirmed, patches exist, exploits are active. The only variable under organisational control is whether to act immediately or risk appearing in the next batch of compromised systems.

Links

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.ncsc.gov.uk/collection/vulnerability-management
• https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/
• https://www.ncsc.gov.uk/cyberessentials/overview