Which versions of Poly Voice are affected by CVE-2026-0826?

Poly Voice products on Linux contain a critical remote code execution vulnerability (CVE-2026-0826, CVSS 9.2) exploitable by unauthenticated network attackers when Interactive Connectivity…. A patch is available.

Is there a public PoC exploit available for CVE-2026-0826?

Yes, a public proof-of-concept exploit is available for CVE-2026-0826. Prioritise patching immediately. EPSS: 0.2%.

How to fix or mitigate CVE-2026-0826?

WITHIN 24 HOURS: Identify all Poly Voice systems on Linux with ICE enabled; prioritize those with external network exposure; disable ICE if operationally feasible or implement immediate network isolation; contact vendor for patch timeline. WITHIN 7 DAYS: Complete asset inventory of affected Poly Voice systems; implement firewall rules restricting network access to trusted sources only; deploy monitoring for exploitation attempts. WITHIN 30 DAYS: Establish subscription to vendor security advisories; evaluate remediation timeline and upgrade strategy; plan alternative voice solutions if ICE cannot be disabled on critical systems.

Poly Voice CVE-2026-0826

Q: What is the CVSS score of CVE-2026-0826?

CVE-2026-0826 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-33658 CRITICAL

Stack-based Buffer Overflow (CWE-121)

2026-06-01 hp-security-alert@hp.com

GHSA-7v6x-2q5v-c59f

RCE Buffer Overflow Stack Overflow

9.2

CVSS 4.0 · Vendor: hp

Severity by source

Vendor (hp) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (hp) · only source for this CVE.

CVSS VectorVendor: hp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 01, 2026 - 16:01 EUVD

Analysis Generated

Jun 01, 2026 - 15:30 vuln.today

CVE Published

Jun 01, 2026 - 15:16 nvd

CRITICAL 9.2

DescriptionCVE.org

In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.

AnalysisAI

Remote code execution in Poly Voice products on Linux is possible through a stack-based buffer overflow reachable when administrators enable Interactive Connectivity Establishment (ICE). Unauthenticated network attackers can trigger the flaw without user interaction, and no public exploit has been identified at time of analysis. HP rates the issue at CVSS 4.0 9.2 (Critical), driven by network reachability and full confidentiality, integrity, and availability impact.

Technical ContextAI

ICE (Interactive Connectivity Establishment, RFC 8445) is a NAT-traversal framework used by SIP/VoIP endpoints to negotiate media paths through STUN/TURN candidates - Poly Voice endpoints implement it to establish real-time audio sessions across firewalls. CWE-121 (Stack-based Buffer Overflow) indicates an undersized stack buffer is written past its bounds while parsing ICE-related input, which on Linux can corrupt the saved return address or adjacent stack frames and enable arbitrary code execution within the affected service process. Because ICE candidate exchange occurs early in signaling, the vulnerable parser is reachable before authentication of any call session.

RemediationAI

Apply the firmware update referenced in HP advisory HPSBPY04083 at https://support.hp.com/us-en/document/ish_15052661-15052687-16/hpsbpy04083 - exact fixed firmware version is not stated in the supplied intelligence, so verify the target build against the vendor advisory before deployment. As a compensating control until patching completes, disable Interactive Connectivity Establishment (ICE) in the device administrative configuration, which fully closes the attack surface described here but will break NAT traversal for off-LAN SIP calls and may require fallback to TURN relay or VPN-anchored signaling. Additionally restrict signaling/media port reachability (typically UDP STUN ports and the SIP signaling ports) to trusted call-control infrastructure via ACLs on the upstream firewall to reduce internet-exposed instances.