# CVE-2026-104811: Mitel MiVoice Office 400 code execution via WAV file upload

Source: https://junglewise.ai/threats/cve-2026-104811-digitalcanion-sa-has-discovered-a-vulnerability-that-allows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104811 · Severity: info · Published 2026-10-05

Mitel MiVoice Office 400 is a unified communications appliance that includes a web portal for configuration. The Music on Hold feature accepts WAV file uploads but fails to validate file types, allowing an attacker to upload a malicious shared library instead. When the system processes the uploaded file, the attacker's code executes with application privileges, potentially compromising the entire underlying Linux system.

Technologies: [Mitel MiVoice Office 400](https://junglewise.ai/threats/technologies/mivoice-office-400). Vendors: [Mitel](https://junglewise.ai/threats/vendors/mitel).

## Quick answers

**Is CVE-2026-104811 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104811 being exploited in the wild.

**How severe is CVE-2026-104811?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Mitel MiVoice Office 400 version 11.0.96.0 and earlier.

**Is there a fix for CVE-2026-104811?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104811 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-104811?** Check whether you run Mitel MiVoice Office 400 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Configuration → Services → Music on Hold web portal component (TCP 443) which accepts audio file uploads. An attacker can bypass file type validation to upload a malicious .so (shared object) file instead of a legitimate WAV audio file. When the affected component processes this file, the attacker-controlled code is loaded and executed in the context of the application process, leading to remote code execution and full system compromise.

## Affected products

- Mitel MiVoice Office 400 version 11.0.96.0 and earlier

## Timeline

- 2026-10-05: disclosed: CVE-2026-104811 / DGI-SWISS-00029 published

## References

- [https://digitalcanion.com/en/security-research/](https://digitalcanion.com/en/security-research/)

## Related threats

- [Mitel MiVoice Office 400 path traversal in file browser](https://junglewise.ai/threats/cve-2026-104810-this-vulnerability-allows-remote-attackers-to-delete-sensitive)
- [Mitel MiVoice Office 400 shared object hijacking arbitrary code execution](https://junglewise.ai/threats/cve-2026-104809-digitalcanion-has-discovered-a-vulnerability-that-allows-an)
- [Mitel MiVoice Office 400 stored XSS in Exchange mailbox field](https://junglewise.ai/threats/cve-2026-104808-digitalcanion-has-discovered-a-stored-cross-site-scripting-xss)
- [Mitel MiVoice Office 400 stored XSS in Domains description](https://junglewise.ai/threats/cve-2026-104807-digitalcanion-has-discovered-a-stored-cross-site-scripting-xss)
- [Mitel MiVoice Office 400 path traversal in System Logs](https://junglewise.ai/threats/cve-2026-104806-digitalcanion-has-discovered-a-path-traversal-vulnerability-that)