Critical severity · published Jun 1, 2026
CVE-2026-0826
Poly Voice – Possible Remote Control of Certain Poly Devices
9.2
CVSS
32.2%
EPSS
No
On KEV
Description
In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable
remote code execution on Poly Voice products on the Linux platform.
Exploitation
Is it being used?
Exploit prediction (EPSS)32.2% · higher than 98% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PO
poly_trio_8300 · HP Inc.
before 8.1.7 · source: vendor
PO
poly_trio_8500 · HP Inc.
before 7.2.8 · source: vendor
PO
poly_trio_8800 · HP Inc.
before 7.2.8 · source: vendor
PO
poly_vvx · HP Inc.
before 6.4.8 · source: vendor
In the news
VulnerabilityCritical
Why an HP Poly VoIP Phones Bug Could Become an Enterprise Foothold
Rapid7 details a critical unauthenticated overflow in HP Poly VoIP phones that can lead to root RCE, with patches available for affected models. Rapid7’s latest disclosure on CVE-2026-0826 should get serious attention from anyone running HP Poly VoIP phones in an enterprise setting. It’s a critical unauthenticated stack-based buffer overflow that can give a remote […]
Jun 3, 2026·Security Affairs