Which versions of Poly CCX are affected by CVE-2026-2891?

HP Poly VoIP phone systems (CCX, Trio C60, Edge E series) are vulnerable to remote denial-of-service attacks that can disable phones on your network through crafted SIP signaling, disrupting voice…. A patch is available.

How to fix or mitigate CVE-2026-2891?

Within 24 hours: Inventory affected HP Poly models (CCX, Trio C60, Edge E series) and verify exposure; subscribe to HP advisory hpsbpy04096 for patch notifications. Within 7 days: Deploy firewall rules restricting SIP server access to authorized sources only; enforce strict SIP source validation on network boundaries. Within 30 days: Apply HP firmware updates immediately upon release per advisory hpsbpy04096; verify remediation across all affected endpoints.

Poly CCX CVE-2026-2891

Q: What is the CVSS score of CVE-2026-2891?

CVE-2026-2891 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-41005 HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-01 hp

GHSA-gvgx-6fx4-x6g9

Denial Of Service HP Ccx Trio C60 Edge E Hp Inc

8.2

CVSS 4.0 · Vendor: hp

Severity by source

Vendor (hp) PRIMARY

8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.9 MEDIUM

Network-facing SIP but AC:H because it requires the device to connect to a malicious/MITM SIP server; no auth (PR:N), and impact is availability-only (A:H, C/I:N).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (hp).

CVSS VectorVendor: hp

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 01, 2026 - 16:01 EUVD

Analysis Generated

Jul 01, 2026 - 14:52 vuln.today

DescriptionCVE.org

The following Poly Voice IP devices, CCX, Trio, and Edge E, might be inoperable if they connect to a malicious SIP server and receive malformed data. HP is releasing updates to mitigate these potential vulnerabilities.

AnalysisAI

Denial of service in HP Poly Voice IP endpoints (CCX, Trio C60, and Edge E series) allows an attacker operating or impersonating a SIP server to render affected devices inoperable by returning malformed data during SIP signaling. The flaw is an uncontrolled-resource-consumption / improper-input-handling issue (CWE-400) that crashes or hangs the phone, disrupting voice service. HP has published advisory hpsbpy04096 and is releasing firmware updates; no public exploit is identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

The affected devices are Poly (HP) VoIP desk and conference endpoints - CCX business media phones, the Trio C60 conference phone, and the Edge E series - which register to and communicate with SIP (Session Initiation Protocol) servers/PBXes for call setup and signaling. The root cause is CWE-400 (Uncontrolled Resource Consumption): the SIP stack on these endpoints fails to safely handle malformed responses/data from the server side, leading to resource exhaustion or a crash that leaves the device inoperable. Because the trust boundary here is the endpoint-to-SIP-server channel, the exposure depends on the device processing attacker-influenced SIP messages rather than on any local access. The CPE data scopes this to hp_inc products ccx, trio_c60, and edge_e across all listed versions.

RemediationAI

Apply the firmware updates HP is releasing for the CCX, Trio C60, and Edge E devices as described in advisory hpsbpy04096 (https://support.hp.com/us-en/document/ish_15222895-15222917-16/hpsbpy04096); patch availability is confirmed per the vendor advisory though a specific fixed version string is not given in the provided data, so obtain the exact build from HP. Until endpoints are updated, reduce exposure by ensuring devices only register to trusted, known SIP servers and by restricting SIP signaling to internal/VLAN-segmented networks - block or filter SIP traffic (typically UDP/TCP 5060 and TLS 5061) from untrusted sources at the firewall, which limits the ability of a rogue server to reach the phones but does not help if the legitimate SIP server itself is compromised. Enforcing SIP over TLS with server authentication mitigates man-in-the-middle injection of malformed data, at the cost of requiring proper certificate configuration on the PBX and endpoints.