Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N N N H H H 9.3 .0043 36.4 —
AFFECTED Product Versions Fixed TVox 26.0.0 – —
TIMELINE Jul 20 Reserved by VulnCheck Aug 3 Published (CNA: VulnCheck) Aug 6 EXPLOIT PUBLISHED — CVE-2026-64827 (Telenia Software TVox). Public exploit reference added.
Telenia Software TVox 26.5.3 and prior 26.x versions, and 24.9.21 and prior 24.x versions, contain an authentication bypass vulnerability in set_env.php where the redirectToLoginAdminIRequestHaveAccessToken() function derives the current page name from PHP_SELF and skips authentication when the value matches 'login_admin.php'. Attackers can append '/login_admin.php' to the path of any target PHP script to cause the authentication check to pass and gain unauthenticated access to all PHP scripts under the manager HTML directory.
| Date | Event | Detail |
|---|---|---|
| July 20, 2026 | Reserved | Reserved by VulnCheck |
| August 3, 2026 | Published | Published (CNA: VulnCheck) |
| August 6, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-64827 (Telenia Software TVox). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Telenia Software | TVox | — | 26.0.0 | — |
Authoritative record: CVE-2026-64827 at cve.org
Vendors: telenia software
Weaknesses: CWE-807
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-64827 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.