Rapid7’s 2026 Global Cybersecurity Summit is now available on-demand.Watch sessions.
Rapid7

module

HP Poly Voice Unauthenticated Remote Code Execution

Try Surface Command
Back to search
Disclosed
Jun 1, 2026
Created
Jun 18, 2026

Description

CVE-2026-0826 is a critical unauthenticated stack-based buffer overflow vulnerability affecting all
models in the VVX series (VVX 150, VVX 250, VVX 350, and VVX 450), as well as three models from the Trio IP
Conference series (Trio 8800, Trio 8500, and Trio 8300). A remote attacker can leverage CVE-2026-0826 to achieve
unauthenticated remote code execution (RCE) with root privileges on a target device. The vulnerability is present
in the device's parsing of Session Description Protocol (SDP) attributes for Interactive Connectivity Establishment
(ICE). The ICE feature, which is not enabled by default, must be enabled for the device to be exploitable by a
remote attacker.

Author

sfewer-r7

Platform

Unix

Architectures

cmd

References

Module Options

To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':


    msf > use exploit/linux/misc/poly_unauth_rce_cve_2026_0826
    msf exploit(poly_unauth_rce_cve_2026_0826) > show targets
        ...targets...
    msf exploit(poly_unauth_rce_cve_2026_0826) > set TARGET < target-id >
    msf exploit(poly_unauth_rce_cve_2026_0826) > show options
        ...show and set options...
    msf exploit(poly_unauth_rce_cve_2026_0826) > exploit
Title
Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report