CVE-2026-104809

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-05

Last updated on: 2026-10-06

Assigner: Switzerland Government Common Vulnerability Program

Description

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-05

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-05

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104809

EUVD

EUVD-2026-92301

Affected Vendors & Products

Vendor	Product	Version / Range
Mitel	Mitel	MiVoice Office 400 11.0.96.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CWE-494	The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-427	The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

Attack-Flow Graph

Executive Summary

This vulnerability allows an attacker to trick the system into loading a malicious shared object (.so) file instead of a legitimate module. The system uses a predictable module name without verifying the file's origin or integrity. When the malicious file is loaded by a privileged process, it executes with the same permissions, leading to arbitrary code execution and full compromise of the Mitel Linux virtual machine.

Detection Guidance

To detect this vulnerability, inspect running processes for unexpected shared object (.so) files being loaded. Check system logs for unusual module loading events. Use commands like 'lsof' to list open files or 'strace' to trace system calls during module loading. Verify integrity of expected .so files against known good versions.

Impact Analysis

An attacker could exploit this to gain full control over the affected system, including executing arbitrary code with high privileges. This could lead to data theft, system manipulation, or disruption of services running on the Mitel Linux virtual machine.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements such as GDPR (data protection) or HIPAA (health information security). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from such security failures.

Mitigation Strategies

Immediately restrict write access to directories where shared objects (.so files) are loaded. Validate module names and their origins before loading. Monitor privileged processes for unexpected .so file loads. Consider disabling dynamic loading of modules if not required.

Hi! I’m here to help you understand CVE-2026-104809. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70