CVE-2026-0826Disclosure

⚠️ In conducting a 0-day research project against an #HP Poly VVX 450 VoIP phone, Rapid7 Labs discovered CVE-2026-0826 – a critical unauthenticated stack-based buffer overflow vuln affecting all VXX series and 3 Trio IP Conference series models. Read on: https://r-7.co/4wQuXul https://t.co/HrMpKBRVFg

CVE-2026-0826 Unauthenticated stack buffer overflow in HP Poly VVX and Trio VoIP Phones (RCE as root) Vulnerable: VVX 150, VVX 250, VVX 350, and VVX 450), as well as Trio IP Conference series (Trio 8800, Trio 8500, and Trio 8300). Link in the comments https://t.co/qKqng6vmoH

CVE-2026-0826: How an Old Bug Can Feed AI-Powered Impersonation https://www.rapid7.com/blog/post/ve-cve-2026-0826-how-an-old-bug-can-feed-ai-powered-impersonation

#NetSec #AppSec 1⃣. Squidbleed (CVE-2026-47729) https://blog.calif.io/p/squidbleed-cve-2026-47729 // Heartbleed-style heap buffer overread in Squid Proxy's FTP parser that leaks internal memory, including HTTP request data, due to a C bug when parsing missing filenames 2⃣. Chaining Security Bugs in Discuz! X5.0: from Race Condition to Pre-Auth RCE https://karmainsecurity.com/chaining-bugs-in-discuz-from-race-condition-to-rce // A chain of vulns in Discuz! X5.0 enables unauthenticated access to RCE through AI-assisted CAPTCHA bypass, database race conditions, token reuse, and LFI exploits, culminating in persistent OS command execution 3⃣. CVE-2026-0826: Critical unauthenticated stack buffer overflow in HP Poly VVX and Trio VoIP Phones https://www.rapid7.com/blog/post/ve-cve-2026-0826-critical-unauthenticated-stack-buffer-overflow-hp-poly-vvx-trio-voip-phones-fixed // Vulnerable: VVX 150, 250, 350, and 450, as well as Trio IP Conference series (Trio 8800, 8500, 8300) 4. Triaging Vulnerability Alerts are simple with Cyber Pocket. http://www.cyberpocket.org/

HP VoIP Phones Critical Enterprise RCE (CVE-2026-0826) CVE-2026-0826. CVSS 9+. Stack-based buffer overflow in HP VoIP phones enables unauthenticated remote code execution. Attackers on the network can pivot from a desk phone to the enterprise LAN. Patch immediately if your org uses HP VoIP hardware. Source: SecurityWeek Full analysis → http://t.me/VulnerabilityNews Follow @VulnerabilityNw

🔒 CYBERSECURITY, PRIVACY & OPEN SOURCE ROUNDUP — June 02, 2026 1️⃣ GOOGLE PATCHES EXPLOITED ANDROID ZERO-DAY CVE-2025-48595 Google released its June 2026 Android Security Bulletin addressing 124 vulnerabilities, including a critical zero-day flaw (CVE-2025-48595) that is already being exploited in targeted attacks. The vulnerability is an integer overflow in the Framework layer affecting Android 14 and later, with confirmed exploitation in the wild. This marks the sixth zero-day with confirmed exploitation since September 2025, underscoring the accelerating pace of mobile threat activity. Device owners are urged to update immediately through the latest security patch. @NewsNerdie 2️⃣ ANTHROPIC EXPANDS MYTHOS AI CYBERSECURITY MODEL TO 200 ORGANIZATIONS Anthropic significantly expanded access to its Mythos cybersecurity AI research model, granting ~200 organizations across power, healthcare, communications, and critical software maintenance sectors the ability to use it. The model has already identified over 10,000 serious software vulnerabilities since its initial release. The EU cybersecurity agency ENISA was also granted access, signaling growing institutional trust in AI-driven vulnerability detection. This represents a major shift toward AI-augmented security operations at scale. @FuturumEquities 3️⃣ ORACLE WEBLOGIC CVE-2026-21962 — CVSS 10.0 RCE ACTIVELY EXPLOITED A critical remote code execution vulnerability in Oracle WebLogic Server (CVE-2026-21962, CVSS 10.0) is being actively exploited in the wild. The flaw allows unauthenticated attackers to achieve RCE via path traversal in the HTTP Server/Proxy Plugin component. Given Oracle WebLogic's widespread deployment in enterprise environments, this poses an immediate and severe risk. Organizations running WebLogic should prioritize patching or deploy compensating controls without delay. @ThreatAft 4️⃣ RED HAT NPM PACKAGES COMPROMISED IN SUPPLY-CHAIN ATTACK More than 30 npm packages under Red Hat's "@redhat-cloud-services" namespace were compromised in a supply-chain attack distributing a new variant of the Shai-Hulud credential-stealing malware. The malicious packages were designed to harvest developer credentials during installation. This incident highlights the persistent risk of package repository compromises and reinforces the need for strict dependency auditing and signed package verification in development workflows. @TechKimmi 5️⃣ WORDPRESS WP MAPS PRO VULNERABILITY BLOCKS 2,800+ ATTACKS IN 24 HOURS A critical vulnerability in the WP Maps Pro WordPress plugin (CVE-2026-8732) allows unauthenticated attackers to create admin-level accounts. Within a single day, over 2,800 exploitation attempts were recorded and blocked by security monitoring services. The fix is available in version 6.1.1. With WordPress powering 43% of all websites, plugin vulnerabilities like this remain one of the most common attack vectors against web infrastructure. @dailytechonx 6️⃣ HP POLY VOICE PHONES VULNERABLE TO ROOT-LEVEL RCE HP Poly Voice VVX and Trio IP phones are affected by a critical flaw (CVE-2026-0826) that enables root-level remote code execution through malicious SIP/SDP traffic when ICE is enabled. This vulnerability can serve as an entry point for broader enterprise network compromise, as VoIP phones are often deployed on the same network segments as corporate devices. Organizations using affected devices should apply vendor patches or disable ICE functionality as an interim measure. @TweetThreatNews 7️⃣ MINECRAFT MALWARE-AS-A-SERVICE: MCAFEE REPORTS WEEDHACK CAMPAIGNS McAfee published a detailed analysis of "WeedHack," a sophisticated Malware-as-a-Service campaign targeting Minecraft players. The operation uses fake Minecraft mods and servers to distribute malware, demonstrating how threat actors increasingly leverage popular gaming platforms to reach younger audiences. The report outlines the full infection chain, infrastructure, and monetization methods behind the campaign, serving as a case study in how gaming communities are being weaponized for cybercrime. @AndreGironda 💭 The cybersecurity landscape in early 2026 shows a clear trend: vulnerabilities are being discovered and exploited faster than ever. From Oracle's CVSS 10.0 WebLogic flaw being weaponized immediately, to Red Hat's own npm supply chain being compromised, the window between disclosure and exploitation continues to shrink. The good news is that AI tools like Anthropic's Mythos are scaling up to meet this challenge, identifying tens of thousands of vulnerabilities before attackers can find them. The race is between automated discovery and automated exploitation — and the side that moves faster wins. Which cybersecurity development surprised you the most this week? Share your thoughts 👇 #Cybersecurity #InfoSec #ZeroDay #OpenSource #Privacy #ThreatIntelligence

Critical zero-day in HP Poly VoIP phones allows unauthenticated remote code execution with root privileges. CVE-2026-0826 affects VVX and Trio series through stack buffer overflow in SDP parsing. Technical breakdown: • CVE-2026-0826 (CVSS 9.2) exploits stack buffer overflow in ParseICECandidate function at 0xB12780 • Vulnerability in SDP "a=candidate:" attribute parsing when ICE feature enabled (non-default) • 256-byte buffer overflow via memcpy() with no bounds checking in /user/local/root/polyapp • Affects VVX 150/250/350/450 and Trio 8300/8500/8800 models running vulnerable firmware • Bypasses NX protection using ROP chain leveraging fixed libc addresses (ASLR ineffective on shared libraries) Attack vector: • Malicious SIP INVITE request to UDP port 5060 with oversized candidate attribute • Payload structure: 12-byte header + 244 A's + 19 B's + register overwrites + shellcode • Achieves immediate root shell without authentication when ICE enabled Hunt for SIP traffic with abnormally long candidate attributes >256 bytes and non-default ICE configurations. Metasploit module available for testing. #DFIR_Radar

Top 5 Trending CVEs: 1 - CVE-2026-45247 2 - CVE-2026-27914 3 - CVE-2017-11882 4 - CVE-2026-45495 5 - CVE-2026-0826 #cve #cvetrends #cveshield #cybersecurity https://www.cveshield.com/dashboard

Why an HP Poly VoIP Phones Bug (CVE-2026-0826) Could Become an Enterprise Foothold via @SecurityAffairs #Proficio #ThreatNews #Cybersecurity #MSSP #MDR https://securityaffairs.com/193045/security/why-an-hp-poly-voip-phones-bug-could-become-an-enterprise-foothold.html

CVE-2026-0826: HP Poly VoIP Phones Stack Buffer Overflow - What It Means for Your Business and How to Respond https://hubs.li/Q04mkmt30

Full Tweet ⚠️ In conducting a 0-day research project against an #HP Poly VVX 450 VoIP phone, Rapid7 Labs discovered CVE-2026-0826 – a critical unauthenticated stack-based buffer overflow vuln affecting all VXX series and 3 Trio IP Conference series models.

CVE-2026-0826: ⚠️ In conducting a 0-day research project against an #HP Poly VVX 450 VoIP phone, Rapid7 Labs discovered CVE-2026-0826 – a critical unauthenticated stack-based buffer overflow vuln affecting all VXX series and 3 Trio IP Conference series models. Read on:…

CVE-2026-0826 (CVSS 9.2): HP Poly VVX/Trio VoIP phones -- no-auth root RCE via crafted SIP INVITE. VVX 150/250/350/450, Trio 8800/8500/8300 all affected. Patches released. Check your VoIP patch cadence. https://dailysecurityreview.com/cyber-security/cve-2026-0826-cvss-9-2-unauthenticated-rce-in-hp-poly-voip-phones/ #CyberSecurity #Vulnerability

🚨2年前に修正されたOracleの脆弱性が攻撃で悪用される 米CISAが警告（CVE-2024-21182） ⚠️HP製VoIP電話機に重大な脆弱性 企業ネットワークへの侵害許す恐れ（CVE-2026-0826） 〜サイバーアラート6月3日〜 https://codebook.machinarecord.com/threatreport/silobreaker-cyber-alert/45906/

『a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.』 CVE-2026-0826 Poly Voice – Possible Remote Control of Certain Poly Devices | HP® Support https://support.hp.com/us-en/document/ish_15052661-15052687-16/hpsbpy04083

CVE-2026-0826: Unauthenticated stack buffer overflow in HP Poly VVX and Trio VoIP Phones (RCE as root) Vulnerable: VVX 150, VVX 250, VVX 350, and VVX 450), as well as Trio IP Conference series (Trio 8800, Trio 8500, and Trio 8300). Blog: https://www.rapid7.com/blog/post/ve-cve-2026-0826-critical-unauthenticated-stack-buffer-overflow-hp-poly-vvx-trio-voip-phones-fixed/

VoIP phones are often overlooked as network devices—but vulnerabilities like CVE-2026-0826 show why they belong in your security program. A critical unauthenticated stack buffer overflow in HP Poly VVX and Trio phones could create serious risk if devices are exposed, unmanaged, or running outdated firmware. What organizations should prioritize now: - Identify all HP Poly VVX and Trio devices across offices, branches, and remote sites - Apply the fixed firmware/update and verify successful deployment - Restrict VoIP device management access with network segmentation, IP allowlisting, and strong admin controls - Review logs and network traffic for unusual device behavior, crashes, scans, or unexpected outbound connections - Remove default credentials and enforce secure configuration baselines - Keep VoIP systems separated from critical business systems to reduce lateral movement risk 𝗩𝗶𝘀𝘁𝗲𝗺 𝗘𝗹𝗲𝘃𝗮𝘁𝗲 𝗽𝗼𝘄𝗲𝗿𝗲𝗱 𝗯𝘆 𝗩𝗶𝘀𝘁𝗲𝗺𝗦𝗲𝗰𝘂𝗿𝗲𝗣𝗿𝗼 helps organizations secure connected infrastructure, reduce vulnerability exposure, and strengthen network resilience with vCISO-led strategy, continuous monitoring, and measurable outcomes. Contact: sales@vistem.com | http://www.vistem.com?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer #Cybersecurity #VoIPSecurity #HPPoly #VulnerabilityManagement #CVE #NetworkSecurity #IncidentResponse #CyberResilience #ZeroTrust #VistemElevate #VistemSecurePro #VistemSolutions #SecurityCompliance https://www.rapid7.com/blog/post/ve-cve-2026-0826-critical-unauthenticated-stack-buffer-overflow-hp-poly-vvx-trio-voip-phones-fixed/?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer

📢 CRITICAL FLAW: A 9.2 CVSS RCE bug (CVE-2026-0826) affects HP Poly VoIP phones. The flaw allows unauthenticated root access. HP has released patches. Update now! #CVE #Vulnerability #RCE #VoIP #PatchNow 🌐 cyber[.]netsecops[.]io https://t.co/0cDabG6YrR

『all shared libraries are loaded starting from a fixed address of 0x40000000 and do not appear to honor ASLR.』 CVE-2026-0826: Critical unauthenticated stack buffer overflow in HP Poly VVX and Trio VoIP Phones (FIXED) https://www.rapid7.com/blog/post/ve-cve-2026-0826-critical-unauthenticated-stack-buffer-overflow-hp-poly-vvx-trio-voip-phones-fixed/

ثغرة قديمة قد تتحول إلى وقود لانتحال الهوية بالذكاء الاصطناعي. يذكّر CVE-2026-0826 بأن المخاطر لا تأتي دائماً من تقنيات جديدة، بل من ثغرات مهملة تُستغل بطرق أكثر تطوراً. Old vulnerabilities can create new AI risks. CVE-2026-0826 shows how a legacy bug may support AI powered impersonation, turning overlooked security debt into a modern identity threat. https://www.rapid7.com/blog/post/ve-cve-2026-0826-how-an-old-bug-can-feed-ai-powered-impersonation #Cybersecurity #CVE #AIImpersonation