CISA lists exploited MikroTik router and Sangoma Switchvox phone system flaws

CISA added several vulnerabilities in small-business network and communications gear to its Known Exploited Vulnerabilities catalog in September 2026. On September 2 it added CVE-2026-9586, a SQL injection flaw in Sangoma Switchvox, a business phone system. On September 10 it added two MikroTik RouterOS flaws, CVE-2026-67277 (missing authentication for a critical function) and CVE-2026-86060 (improper neutralization of command argument delimiters), and on September 25 a third, CVE-2026-67279. CISA only lists vulnerabilities once it has evidence of exploitation.

Routers like MikroTik's often sit at the network edge in small offices and branch sites with little ongoing attention, and they are sometimes installed by a carrier or a past vendor. A compromised business phone system can lead to toll fraud, eavesdropping or a foothold into the office network. Neither type of device usually gets the patching discipline that servers and laptops receive.

Find out whether you have either product in place; branch routers and older phone systems are sometimes installed by a carrier or a past vendor and forgotten. If so, ask the responsible party to confirm the current firmware or software version against the vendor's fixed release, and to confirm that management interfaces are not open to the internet. For Switchvox, also review call detail records for unusual international or after-hours calls.

If no one can say who maintains these devices, that is the first gap to close. Assign an owner and a patch schedule for every device that sits on the network edge.