What’s Vulnerable › Vulnerabilities

CVE-2026-67609: Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-03 · updated 2026-09-09
• Weakness: CWE-250

Description

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password.

Affected products

• Telenia Software TVox: from 26.0.0 through 26.5.3; from 24.0.0 through 24.9.21

References

• https://karmainsecurity.com/KIS-2026-16
• https://www.teleniasoftware.com/
• https://www.vulncheck.com/advisories/telenia-tvox-privilege-escalation-via-insecure-sudoers-configuration

Get alerted when CVE-2026-67609 or the next vulnerability affects your stack