Which versions of Telenia TVox are affected by CVE-2026-67608?

Telenia Software TVox contains a command injection vulnerability affecting versions 24.x through 26.5.3 that allows authenticated high-privilege users to execute arbitrary operating system commands,…

Is there a public PoC exploit available for CVE-2026-67608?

Yes, a public proof-of-concept exploit is available for CVE-2026-67608. Prioritise patching immediately. EPSS: 1.5%.

How to fix or mitigate CVE-2026-67608?

Within 24 hours, inventory all Telenia TVox deployments in production and document version numbers to identify affected systems (24.x through 26.5.3). Immediately restrict administrative access to TVox to only essential personnel and verify that TVox systems are not directly exposed to untrusted networks. Within 7 days, disable the action_audio.php endpoint if operationally feasible, reduce Apache process privileges to minimum required permissions, and implement enhanced audit logging on all TVox systems. Within 30 days, monitor Telenia's security advisories for a patched version, establish a testing plan for production upgrades once patches are released, and consider evaluating alternative solutions if the vendor's patch timeline is not clearly communicated.

Telenia TVox CVE-2026-67608

Q: What is the CVSS score of CVE-2026-67608?

CVE-2026-67608 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 1.5%.

EUVD-2026-52293 HIGH

OS Command Injection (CWE-78)

2026-08-03 VulnCheck

GHSA-jgv8-7p8x-qfg2

PHP Apache Command Injection Tvox Telenia Software

8.6

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.2 HIGH

Network-reachable PHP endpoint requires high-privilege authentication; scope unchanged as execution is constrained to the apache user on the vulnerable host with no cross-system impact described.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Aug 03, 2026 - 14:30 vuln.today

CVE Published

Aug 03, 2026 - 13:30 cve.org

HIGH 8.6

DescriptionCVE.org

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.

Articles & Coverage 2

News 5 New Apache Vulnerabilities - 5 High Severity, 2 With POC Aug 04, 2026 News 3 New Apache Vulnerabilities - 1 Critical, 2 With POC Aug 03, 2026

AnalysisAI

OS command injection in Telenia Software TVox allows authenticated high-privilege attackers to execute arbitrary operating system commands via the unsanitized pid parameter in action_audio.php. Affected deployments span TVox 26.x through 26.5.3 and 24.x through 24.9.21, running on an Apache/PHP stack where successful exploitation yields command execution as the apache system user. A publicly available proof-of-concept exploit exists (KarmaInSecurity KIS-2026-15, confirmed by VulnCheck), though no CISA KEV listing is present, indicating active exploitation is not yet confirmed at scale.

Technical ContextAI

TVox is a unified communications platform developed by Telenia Software, deployed on an Apache/PHP web stack as indicated by the CPE cpe:2.3:a:telenia_software:tvox and the Apache/PHP tags. The vulnerability resides in action_audio.php, a PHP script handling audio process management operations. When the action request parameter is set to checkProcess, the script passes the user-supplied pid parameter directly into a PHP exec() call without sanitization - a classic CWE-78 (Improper Neutralization of Special Elements used in an OS Command) root cause. Shell metacharacters (e.g., semicolons, pipes, backticks) in the pid value are interpreted by the underlying shell, allowing arbitrary command injection. Because the Apache web server process owns the execution context, injected commands run with the privileges of the apache OS user.

RemediationAI

Upgrade Telenia TVox to a version beyond 26.5.3 (for 26.x deployments) or 24.9.21 (for 24.x deployments); no specific patched release version number is independently confirmed from the available references, so consult the vendor directly at https://www.teleniasoftware.com/ or the VulnCheck advisory at https://www.vulncheck.com/advisories/telenia-tvox-os-command-injection-via-action-audio-php to identify the exact fixed release. As an immediate compensating control pending patch deployment, restrict external and untrusted-network access to action_audio.php via Apache mod_authz_host directives or a WAF rule blocking requests where action=checkProcess is present - note this may break legitimate audio process management functionality within the TVox interface. Additionally, audit and rotate all high-privilege TVox administrative credentials to limit the attacker pool, given that PR:H authentication is the primary exploitation prerequisite. The full technical details of the vulnerability are disclosed in the KarmaInSecurity advisory at https://karmainsecurity.com/KIS-2026-15.