CVE-2026-104809
Received Received - Intake

Arbitrary Code Execution in Mitel Linux Virtual Machine via Malicious .so File

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: Switzerland Government Common Vulnerability Program

Description
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-104809
EUVD
EUVD-2026-92301

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CWE-829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-426 The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an attacker to trick the system into loading a malicious shared object (.so) file instead of a legitimate module. The system uses a predictable module name without verifying the file's origin or integrity. When the malicious file is loaded by a privileged process, it executes with the same permissions, leading to arbitrary code execution and full compromise of the Mitel Linux virtual machine.

Impact Analysis

An attacker could exploit this to gain full control over the affected system, including executing arbitrary code with high privileges. This could lead to data theft, system manipulation, or disruption of services running on the Mitel Linux virtual machine.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating compliance requirements such as GDPR (data protection) or HIPAA (health information security). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from such security failures.

Mitigation Strategies

Immediately restrict write access to directories where shared objects (.so files) are loaded. Validate module names and their origins before loading. Monitor privileged processes for unexpected .so file loads. Consider disabling dynamic loading of modules if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104809. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart