CVE-2026-104809: Mitel MiVoice Office 400 Shared Object Hijacking Leading to Arbitrary Code Execution

Vulnerability summary

CVE-2026-104809 is a high (CVSS 8.4) External Control of File Name or Path vulnerability in mitel mitel mivoice office 400. EPSS estimates a 0.10% chance of exploitation in the next 30 days, higher than 0.6% of scored vulnerabilities.

Timeline

1. 05-10-2026
   PublishedVulnerability first disclosed.
2. 05-10-2026
   Last modifiedVulnerability information updated.

Description

DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.

• CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
• CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
• CWE-427Uncontrolled Search Path ElementThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
• CWE-494Download of Code Without Integrity CheckThe product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
• CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.