KEV Lag Tracker → CVE-2026-9586. Data verified against the official CISA KEV catalog and the National Vulnerability Database.
CISA added CVE-2026-9586 (Sangoma Switchvox) to the Known Exploited Vulnerabilities catalog on September 2, 2026. It was publicly known for 47 days before CISA confirmed active exploitation. A KEV listing is CISA’s official confirmation that a vulnerability is being exploited in the wild.
The Record
| CVE | CVE-2026-9586 |
| Vendor / product | Sangoma Switchvox |
| Vulnerability | Sangoma Switchvox SQL Injection Vulnerability |
| CVSS base score | 9.8 |
| EPSS probability the day before the KEV listing | 0.43% (36.3% percentile) |
| NVD publication date | July 17, 2026 |
| Added to CISA KEV | September 2, 2026 |
| Lag (public → KEV listing) | 47 days |
| Federal patch deadline | September 5, 2026 |
| Known ransomware use | No |
Measured against the 1712 entries in our tracker with verified publication dates, CVE-2026-9586 was flagged faster than 65% of them.
What CISA Reported
CISA describes the flaw as follows: “Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.”
Federal Patch Deadline
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-9586 by September 5, 2026 — a 3-day remediation window from the KEV listing date. Private organizations are not bound by that deadline; CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
What EPSS Forecast Before the Confirmation
The EPSS forecast (FIRST’s daily estimate of the probability a CVE will be exploited within 30 days) put CVE-2026-9586 at 0.43% on the day before CISA confirmed active exploitation — the 36.3% percentile of all scored CVEs that day. That places it outside the top 10% of EPSS risk on the eve of confirmation — a patch queue ordered by EPSS alone would have left it for later.
| EPSS for CVE-2026-9586 | Value |
|---|---|
| Probability the day before the KEV listing | 0.43% |
| Percentile the day before the KEV listing | 36.3% |
| Probability today (September 17, 2026) | 11.85% |
| Percentile today | 95.9% |
Today’s figure is not evidence that the forecast worked: EPSS reacts to the KEV listing itself, so the score for any confirmed-exploited CVE tends to rise after CISA acts. Only the eve-of-listing number was available to a defender making the call. Across every KEV entry we track, we measured how often that number was high — see the EPSS accuracy analysis.
How This Compares
We do not yet track enough Sangoma entries to publish a vendor median (the threshold is five with verified publication dates), so the reference here is the catalog as a whole:
| Across all tracked KEV entries | Value |
|---|---|
| Entries with verified publication dates | 1712 |
| Median lag (disclosure → KEV listing) | 251 days |
| Exploited within 7 days of disclosure | 24% |
| Tied to known ransomware campaigns | 19% |
Other Recent Sangoma KEV Additions
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2025-64328 | FreePBX | February 3, 2026 | 88 | No |
| CVE-2019-19006 | FreePBX | February 3, 2026 | 2266 | No |
| CVE-2025-57819 | FreePBX | August 29, 2025 | 1 | No |
Defense guide: How to Detect SQL Injection: Attack Chain & Defense (2026) — detection signals, attack chain and response steps for this class of attack.
Frequently Asked Questions
What is CVE-2026-9586?
CVE-2026-9586 is a vulnerability in Sangoma Switchvox (Sangoma Switchvox SQL Injection Vulnerability) that CISA added to its Known Exploited Vulnerabilities catalog on September 2, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild.
How long was CVE-2026-9586 public before CISA confirmed exploitation?
47 calendar days, measured from its NVD publication date to the date CISA added it to the KEV catalog.
What is the federal patch deadline for CVE-2026-9586?
U.S. federal agencies must remediate CVE-2026-9586 by September 5, 2026, a 3-day window from the KEV listing date. Private organizations are not bound by that deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
Is CVE-2026-9586 used in ransomware campaigns?
CISA has not flagged CVE-2026-9586 as known to be used in ransomware campaigns. That field reflects confirmed campaign use, not the absence of risk.
What was the EPSS score for CVE-2026-9586 before it was confirmed as exploited?
0.43% — the probability EPSS assigned on the day before CISA added CVE-2026-9586 to the KEV catalog, placing it in the 36.3% percentile of all scored CVEs that day. That is outside the top 10% of EPSS risk. Its score today is higher in most cases because EPSS reacts to the KEV listing itself, so only the eve-of-listing figure reflects what a defender could have acted on.
Is a 47-day lag typical?
The median across all 1712 KEV entries we track with verified publication dates is 251 days, so CVE-2026-9586 is below the catalog median.
Related Coverage
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
- WordPress’s CVE-2026-63030 Was Exploited in 4 Days — Well Under Its 420-Day Median (July 2026)
Primary Sources
- CISA Known Exploited Vulnerabilities Catalog — the official listing that confirms active exploitation, and the source of the KEV date on this page.
- NVD — CVE-2026-9586 — publication date, CVSS score and the full technical record.
- Vendor advisory — sangomakb.atlassian.net — Sangoma’s own disclosure, with the affected versions and the fix.
How We Track This
This page is generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No date or figure on this page is estimated or taken from a third-party source — they come directly from CISA and NVD records. Free to cite with attribution to CVEDaily (CC BY 4.0).