Medium severity · published Jul 8, 2026
CVE-2026-5922
Poly Voice – Potential Unauthorized Modification of WebUI using XSS Attack
5.9
CVSS
0.4%
EPSS
No
On KEV
Description
The IP phone might use malicious input stored in configuration parameters and render it as content for the WebUI’s webpage.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PC
Poly CCX · HP Inc.
before 9.5.0 · source: vendor
PE
Poly Edge E · HP Inc.
before 8.6.0 · source: vendor
PT
Poly Trio C60 · HP Inc.
before 9.5.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-5922
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-5922
support.hp.com
https://support.hp.com/us-en/document/ish_15255534-15255565-16/hpsbpy04108
More from Poly CCX
6.0
CVE-2026-5923
Poly Voice – Potential Unauthorized Modification of WebUI using CSRF Attack