CVE-2026-95615: Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API

Q: Who can exploit this issue?

A remote authenticated user can exploit it. The attack requires access to the audio messages API and the ability to supply a filename parameter to the /api/system/audio_messages endpoint.

Q: What level of access could an attacker obtain?

Successful exploitation allows arbitrary OS command execution as root within the hiatus application container. The provided information does not establish access beyond that container.

Q: Which deployments are affected?

Zenitel Connect versions before 1.11.0 are affected. The available information does not state whether the vulnerable API is enabled or reachable in a default configuration.

Q: How can I determine whether my system is affected?

Check the installed Zenitel Connect version. Systems running a version earlier than 1.11.0 should be treated as affected based on the provided advisory information.

Published Nov 13, 2026

Updated

OS command injection vulnerability in audio messages API in Zenitel Connect before 1.11.0 allows remote authenticated users to execute arbitrary OS commands as root in the hiatus application container via filename parameter to the /api/system/audiomessages endpoint.

Affected Software

1 affected component

Zenitel Zenitel Connect<1.11.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Zenitel Connect to a version that resolves this vulnerability.
Fixed in 1.11.0

Event History

Nov 13, 2026

CVE Published

via MITRE·03:45 PM

Data Sourced

via MITRE·03:45 PM

RemedyDescriptionWeakness

Data Sourced

via NVD·04:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

A remote authenticated user can exploit it. The attack requires access to the audio messages API and the ability to supply a filename parameter to the /api/system/audio_messages endpoint.

What level of access could an attacker obtain?

Successful exploitation allows arbitrary OS command execution as root within the hiatus application container. The provided information does not establish access beyond that container.

Which deployments are affected?

Zenitel Connect versions before 1.11.0 are affected. The available information does not state whether the vulnerable API is enabled or reachable in a default configuration.

How can I determine whether my system is affected?

Check the installed Zenitel Connect version. Systems running a version earlier than 1.11.0 should be treated as affected based on the provided advisory information.

CVE-2026-95615: Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What level of access could an attacker obtain?

Which deployments are affected?

How can I determine whether my system is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What level of access could an attacker obtain?

Which deployments are affected?

How can I determine whether my system is affected?