What’s Vulnerable › Vulnerabilities

CVE-2026-67608: Telenia TVox 26.5.3 OS Command Injection via action_audio.php

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-03 · updated 2026-10-23
• Weakness: CWE-78

Description

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an OS command injection vulnerability in action_audio.php that allows authenticated attackers to execute arbitrary operating system commands by passing an unsanitized pid parameter into an exec() call when the action parameter is set to checkProcess. Attackers can inject malicious OS commands through the pid request parameter to execute arbitrary commands with the privileges of the apache user.

Affected products

• Telenia Software TVox: from 26.0.0 through 26.5.3; from 24.0.0 through 24.9.21

References

• https://karmainsecurity.com/KIS-2026-15
• https://www.teleniasoftware.com/
• https://www.vulncheck.com/advisories/telenia-tvox-os-command-injection-via-action-audio-php

Get alerted when CVE-2026-67608 or the next vulnerability affects your stack