This page is the official source for security advisories affecting Zenitel’s products; advisories reference CVE identifiers where assigned. This page and all linked advisories are publicly available at no cost, require no account or login, and are free to reuse.
Disclosure policy: https://www.zenitel.com/security/vulnerability-disclosure
Advisories list
| Advisory | Title | CVE ID(s) | Published | Severity |
| A100K12404 | VS-IS OS command injection via DHCP option 66 in Zenitel EdgeAudioClient TFTP provisioning | CVE-2026-95377 | 13.11.2026 | Critical (9.4 (v4.0)) |
| A100K12404 | VS-IS Path traversal in Zenitel turbineweb certificate upload allows arbitrary file write as root | CVE-2026-95378 | 13.11.2026 | High (8.6 (v4.0)) |
| A100K12404 | VS-IS Path traversal in Zenitel turbineweb certificate delete RPC allows arbitrary file deletion as root | CVE-2026-95379 | 13.11.2026 | High (7.0 (v4.0)) |
| A100K12404 | Zenitel Connect pREST API adopts arbitrary PostgreSQL role from unvalidated JWT sub claim | CVE-2026-95613 | 13.11.2026 | High (8.6 (v4.0)) |
| A100K12404 | Zenitel Connect host applies rsyslog configuration written to a volume shared with the hiatus container | CVE-2026-95614 | 13.11.2026 | Critical (9.3 (v4.0)) |
| A100K12404 | Zenitel Connect OS command injection in hiatus container via unsanitized filename in audio messages API | CVE-2026-95615 | 13.11.2026 | High (8.7 (v4.0)) |
| A100K12404 | Zenitel Connect missing lockout and rate limiting on the WAMP-CRA authentication channel | CVE-2026-105622 | 13.11.2026 | Medium (6.3 (v4.0)) |
| A100K12404 | Zenitel Connect web interface serves production JavaScript source maps without authentication | CVE-2026-105623 | 13.11.2026 | Medium (6.9 (v4.0)) |
| A100K12404 | Zenitel Connect login allows account-lockout denial of service | CVE-2026-105624 | 13.11.2026 | Medium (6.9 (v4.0)) |
| A100K12404 | Zenitel Connect web interface loads integration iframe without sandboxing or origin restriction | CVE-2026-105625 | 13.11.2026 | Medium (5.1 (v4.0)) |
| A100K12404 | Zenitel Connect login allows username enumeration via verbose error responses | CVE-2026-105671 | 13.11.2026 | Medium (6.9 (v4.0)) |
| A100K12412 | Exigo PHP RCE via OOM corruption | CVE-2026-109618 | 27.10.2026 | Critical (9.2 (v4.0)) |
| A100K12412 | Exigo PHP RCE via stale global state | CVE-2026-109619 | 27.10.2026 | Critical (9.2 (v4.0)) |
| A100K12411 | ICX-AlphaCom PHP RCE via OOM corruption | CVE-2026-109618 | 23.10.2026 | Critical (9.2 (v4.0)) |
| A100K12411 | ICX-AlphaCom PHP RCE via stale global state | CVE-2026-109619 | 23.10.2026 | Critical (9.2 (v4.0)) |
| A100K12333 | VS-IS OS Command Injection | CVE-2025-64126 | 19.12.2025 | Critical (10.0) |
| A100K12333 | VS-IS OS Command Injection | CVE-2025-64127 | 19.12.2025 | Critical (10.0) |
| A100K12333 | VS-IS OS Command Injection | CVE-2025-64128 | 19.12.2025 | Critical (10.0) |
| A100K12333 | VS-IS Out-of-bounds Write | CVE-2025-64129 | 19.12.2025 | High (7.0) |
| A100K12333 | VS-IS Cross-site Scripting | CVE-2025-64130 | 19.12.2025 | Critical (9.3) |
| A100K12333 | VS-IS Authenticated Remote Code Execution | CVE-2025-59817 | 19.12.2025 | High (8.4) |
| A100K12333 | VS-IS Authenticated Remote Code Execution | CVE-2025-59818 | 19.12.2025 | Critical (10.0) |
| A100K12333 | ICX-AlphaCom Unauthenticated SQL-injection | CVE-2025-59814 | 19.12.2025 | High (8.8) |
| A100K12333 | ICX-AlphaCom Authenticated Remote Code Execution | CVE-2025-59815 | 19.12.2025 | High (8.4) |
| A100K12333 | ICX-AlphaCom Authenticated Union based SQL-injection | CVE-2025-59816 | 19.12.2025 | High (7.3) |
| A100K12333 | AlphaCom XE Authenticated Arbitrary File Read | CVE-2025-59819 | 19.12.2025 | Medium (6.5) |
| A100K12333 | VS-IS Authenticated Remote Code Execution | CVE-2025-64090 | 19.12.2025 | Critical (10.0) |
| A100K12333 | VS-IS Authenticated Remote Code Execution | CVE-2025-64091 | 19.12.2025 | High (8.6) |
| A100K12333 | ICX-AlphaCom/AlphaCom XE Unauthenticated SQL injection | CVE-2025-64092 | 19.12.2025 | High (7.5) |
| A100K12333 | ICX-AlphaCom/AlphaCom XE Unauthenticated Remote Code Execution | CVE-2025-64093 | 19.12.2025 | Critical (10.0) |