Which versions of Telenia TVox are affected by CVE-2026-64827?

Telenia Software TVox (versions 24.x through 26.x) contains a critical authentication bypass vulnerability allowing remote attackers to access administrative functions without valid credentials.

Is there a public PoC exploit available for CVE-2026-64827?

Yes, a public proof-of-concept exploit is available for CVE-2026-64827. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate CVE-2026-64827?

Within 24 hours: identify all TVox deployments (versions 24.x ≤24.9.21 and 26.x ≤26.5.3) in your environment, document access levels and network exposure, and isolate critical instances from untrusted networks if feasible. Within 7 days: implement Web Application Firewall rules to block HTTP requests containing '/login_admin.php' appended paths, enable comprehensive access logging on manager directory activity, and contact Telenia Software for patch timeline or interim workarounds. Within 30 days: deploy patched TVox versions when released by the vendor (monitor Telenia advisories closely) or begin migration to alternative platforms; conduct forensic analysis of access logs for exploitation indicators and audit all administrative account activities from the vulnerability disclosure date forward.

Telenia TVox CVE-2026-64827

Q: What is the CVSS score of CVE-2026-64827?

CVE-2026-64827 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-52292 CRITICAL

Reliance on Untrusted Inputs in a Security Decision (CWE-807)

2026-08-03 VulnCheck

GHSA-9v39-f83v-66p8

PHP Authentication Bypass Tvox Telenia Software

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Remote, deterministic path-suffix bypass needs no auth or interaction (AV:N/AC:L/PR:N/UI:N); unauthenticated access to all manager scripts yields high C/I/A with no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 14:29 vuln.today

CVE Published

Aug 03, 2026 - 13:26 cve.org

CRITICAL 9.3

DescriptionCVE.org

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.

Articles & Coverage 1

News Critical Authentication Bypass in Telenia Software TVox - CVE-2026-64827 Aug 03, 2026

AnalysisAI

Authentication bypass in Telenia Software TVox (versions 24.x ≤24.9.21 and 26.x ≤26.5.3) lets remote unauthenticated attackers reach every PHP script under the manager HTML directory by appending '/login_admin.php' to any target script's path. The flaw stems from set_env.php trusting the client-controllable PHP_SELF value when deciding whether to skip authentication. Publicly available exploit code exists (KarmaInSecurity KIS-2026-14, reported by VulnCheck), but there is no CISA KEV listing, so treat it as no public active exploitation confirmed despite a ready POC.

Technical ContextAI

TVox is Telenia Software's PHP-based unified-communications/PBX management platform; the affected surface is the web 'manager' interface served by PHP scripts. The root cause is CWE-807 (Reliance on Untrusted Inputs in a Security Decision): the redirectToLoginAdminIRequestHaveAccessToken() gatekeeper in set_env.php derives the 'current page' from PHP_SELF and skips the auth check when that value equals 'login_admin.php'. Because PHP_SELF reflects the full request path (including PATH_INFO), it is attacker-influenced rather than a trustworthy server-side identifier, so a request like /some_admin_script.php/login_admin.php makes PHP_SELF end in 'login_admin.php' and satisfies the bypass while still executing the intended target script. The single affected CPE is cpe:2.3:a:telenia_software:tvox:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a TVox release newer than the affected ceilings - beyond 24.9.21 on the 24.x line and beyond 26.5.3 on the 26.x line; the input does not name an exact fixed build, so treat this as 'Patch available per vendor advisory' and confirm the precise fixed version directly with Telenia (https://www.teleniasoftware.com/) and the advisories at https://karmainsecurity.com/KIS-2026-14 and https://www.vulncheck.com/advisories/telenia-tvox-authentication-bypass-via-set-env-php. Until patched, restrict network access to the TVox manager HTML directory to trusted management networks or VPN only, which removes internet exposure at the cost of remote admin convenience. As a targeted compensating control, add a web-server/WAF rule that rejects requests whose PATH_INFO appends '/login_admin.php' (or any extra path segment) after a '.php' script, since legitimate requests do not need a PHP script suffixed with another script name; test this rule carefully to avoid breaking any application URLs that legitimately rely on PATH_INFO. Do not rely on the built-in auth gate alone, as it is the failing component.