Loading story…
HP disclosed CVE-2026-0826, a critical buffer overflow vulnerability in certain Poly Voice devices running on Linux that can lead to remote code execution and possible remote control of affected systems. The flaw carries a CVSS v4.0 score of 9.2 and is remotely exploitable with low attack complexity, no privileges, and no user interaction, but only in deployments where an administrator has enabled Interactive Connectivity Establishment (ICE).
According to HP bulletin HPSBPY04083, affected products include VVX, Trio 8300, Trio 8500, and Trio 8800 devices. HP urged customers to update to the latest UCS firmware through HP Poly Lens and advised disabling ICE connectivity where it is not needed. The issue was reported by Stephen Fewer of Rapid7 and is classified under CWE-121.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
Public technical details and exploit code for CVE-2026-0826, including a Metasploit module, were released, providing deeper analysis of the ParseICECandidate buffer overflow and making exploitation easier. The reporting also noted ASLR weaknesses on affected devices that facilitate ROP-style exploitation.
On 2026-06-01, CVE-2026-0826 was recorded as affecting HP Poly Voice products, with the issue described as a buffer overflow that may lead to remote code execution in certain scenarios. The entry assigns CWE-121 and notes a CVSS v4.0 severity indicating network attackability and high impact.
On 2026-06-01, HP published security bulletin HPSBPY04083 Rev. 1 disclosing CVE-2026-0826, a critical buffer overflow vulnerability that can enable remote code execution on certain Linux-based Poly Voice devices when ICE is enabled. HP advised customers to update to the latest UCS firmware via HP Poly Lens and to disable ICE when not needed.
HP's bulletin credits Stephen Fewer of Rapid7 with reporting the vulnerability affecting certain Poly Voice devices. The references do not provide a specific date for when the report was made.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcesecurityaffairs.com
Open sourcecyber.gc.ca
Open sourcecvefeed.io
Open sourcesupport.hp.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Rapid7 disclosed **`CVE-2026-0826`**, a critical unauthenticated stack-based buffer overflow in HP Poly **VVX** and **Trio** VoIP phones that can allow remote code execution as **root**. The flaw resides in SDP parsing of ICE candidate attributes within the `polyapp` binary when the non-default **ICE** feature is enabled. Rapid7 demonstrated exploitation against a Poly VVX 450 running firmware `6.4.7.4477`, showing that existing mitigations were not sufficient in practice: **NX** was enabled, but the binary lacked **PIE**, and some shared libraries loaded at fixed addresses despite nominal **ASLR**, enabling a **ROP**-based exploit. HP said the issue affects all VVX models and several Trio conference phones, assigned it a **CVSSv4 9.2**, and released patched firmware while advising administrators to disable ICE if it is not required. The disclosure also warned that compromised enterprise desk phones can become stealthy footholds for persistence, lateral movement, traffic interception, and call manipulation, while exposing sensitive audio from executive offices and conference rooms. Rapid7 said the risk extends beyond traditional espionage because control of trusted business phones could support **AI-enabled impersonation**, including vishing and deepfake-assisted fraud, underscoring that VoIP endpoints should be treated as fully networked computers rather than benign office appliances.
Jun 29, 2026
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jul 23, 2026
Rapid7 disclosed **CVE-2026-2329**, a critical unauthenticated **stack-based buffer overflow** (CWE-121) in the Grandstream **GXP1600** series VoIP phones that can be exploited for **remote code execution (RCE) as `root`**. The flaw is reachable via the phone’s web-based HTTP API in default configurations, specifically the endpoint ` /cgi-bin/api.values.get `, and impacts all models sharing the common firmware image: **GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630**. Public scoring cited includes **CVSS v4.0 9.3 (Critical)** with network attack vector and no privileges or user interaction required. Rapid7 demonstrated exploitability by developing a **Metasploit** exploit module (plus a post-exploitation module) showing unauthenticated compromise of a vulnerable device (e.g., GXP1630 on firmware **1.0.7.79**) and subsequent credential collection (including local and SIP accounts). Rapid7 also highlighted operational risk beyond device takeover: with root access, an attacker could alter SIP configuration to route calls through attacker-controlled infrastructure, enabling covert call interception. Grandstream has released a firmware fix, **version 1.0.7.81**, to remediate the issue, and the disclosure is tracked via Grandstream PSIRT and Metasploit references.
Jun 29, 2026