Vulnerability · Published Aug 3, 2026 · Assigned by VulnCheck

CVE-2026-67609Telenia TVox 26.5.3 Privilege Escalation via Insecure sudoers Configuration

High 7.8

In plain English

A high-severity security flaw in TVox from Telenia Software. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)0.2%top 90.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain a privilege escalation vulnerability that allows attackers with access to the apache account to execute arbitrary commands as root by exploiting an insecure sudoers configuration in /etc/sudoers.d/telenia. The configuration grants the apache user NOPASSWD execution of /bin/nice, which can be leveraged to invoke arbitrary commands, enabling full root-level command execution without supplying a password.

Affected products (as reported)

Vendor	Product	Versions
Telenia Software	TVox	26.0.0 – through 26.5.324.0.0 – through 24.9.21

Weakness: CWE-250 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Karma(in)Security Disclosure (KIS-2026-16) technical-description, exploit
Supplier Homepage product
https://www.vulncheck.com/advisories/telenia-tvox-privilege-escalation-via-insecure-sudoers-configuration third-party-advisory