CVE-2026-67609: Telenia Software Tvox

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password.

Affected products

• Telenia Software Tvox: from 26.0.0, up to and including 26.5.3; from 24.0.0, up to and including 24.9.21

Published 2026-08-03. Last modified 2026-09-09.