Mitel MiVoice Office 400: Shared object hijacking leading to code execution
Summary
Mitel MiVoice Office 400 loads a shared library (.so) by a predictable name without verifying its origin or integrity. A local attacker with high privileges can place a malicious shared object with the expected name, which a privileged process then loads and executes with its privileges. The research finder reports that this leads to arbitrary code execution and full compromise of the Linux virtual machine, as root.
Affected
- Mitel MiVoice Office 400 11.0.96.0 (per CVE record)
- Other versions: Unknown.
Fixed in
Unknown.
Workaround
Unknown. No vendor mitigation for this CVE was found.
Exploitation
- Not known to be exploited.
- No public proof of concept found.
- The CVSS exploit maturity value E:P is assigned by the CNA and is not evidence of a public exploit.
Our recommendation
- Inventory MiVoice Office 400 systems and check whether any run version 11.0.96.0.
- Ask your Mitel partner for the current advisory and the fixed release.
- Restrict access to the web management portal (TCP 443) to management networks or VPN, and review administrator accounts, as this is the most likely route to the required privileges.
- Check the Linux VM for unexpected shared object files in application paths and monitor for changes.
- Re-check NVD, the NCSC CVE records and Mitel's security advisories for updates.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- DigitalCanion security research digitalcanion.com
- Swiss NCSC CVE records (CNA) www.bacs.admin.ch
- CVE-2026-104809 record summary (threatint) cve.threatint.com
- CVE-2026-104809 on Strix www.strix.ai
- CVE-2026-104809 on OffSeq Radar radar.offseq.com
- CVE-2026-104809 on HOL Guard hol.org
- Mitel product security advisory 23-0009 www.mitel.com
- Related CVE-2026-104811 on Strix www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:52.
Original description (NVD)
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without adequately verifying the file’s origin or integrity. A malicious shared object using the expected name can therefore be loaded by a privileged process. The module code then executes within the context and privileges of that process. This results in arbitrary code execution and full compromise of the Mitel Linux virtual machine.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.