CVE-2026-104809
Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution
- Published
- Updated
- Reserved
- Assigned by
- NCSC.ch
Description
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NCSC.chCNA (assigner) | 4.0 | High8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/U:Amber |
| NVDNVD · Deferred | 4.0 | High8.4 | CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Amber |
- EPSS (exploitation in 30 days)
- 0.10% · top 99% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.4.
Weakness
- CWE-73 External control of file name or path (opens in a new tab)All about CWE-73 and its CVEs
- CWE-494 Download of code without integrity check (opens in a new tab)All about CWE-494 and its CVEs
- CWE-829 Inclusion of functionality from untrusted control sphere (opens in a new tab)All about CWE-829 and its CVEs
- CWE-426 — Untrusted Search Path (opens in a new tab)All about CWE-426 and its CVEs
- CWE-427 — Uncontrolled Search Path Element (opens in a new tab)All about CWE-427 and its CVEs
Affected products
Mitel · Mitel MiVoice Office 400
- affected 11.0.96.0
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-104809)Record last updated .