Read the docs
TI-2018-11136 Aliases CVE-2018-15611GHSA-pj9j-p4rf-x438

Communication Manager Local Administrator PrivEsc

Priority LOW 29CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1.

Why it matters now

EPSS 0.00297 22nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AvayaCommunication Manager7.1.3.1 and later; 6.3.x and later—No fix listedCNA
  • Communication Manager VendorAvaya Affected 7.1.3.1 and later; 6.3.x and later Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:avaya:aura_communication_manager:*:*:*:*:*:*:*:*6.3.0.1 – 6.3.17.0; 7.0 to before 7.1.3.1VulnerableAvaya
  • cpe:2.3:a:avaya:aura_communication_manager:*:*:*:*:*:*:*:* Versions 6.3.0.1 – 6.3.17.0; 7.0 to before 7.1.3.1 Vulnerable ·Avaya

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-15611
  2. 2026-10-03 Alias added: GHSA-pj9j-p4rf-x438

References

Advisory 1

  • TI-2010-02816 The xfs implementation in the Linux kernel before 2.6.35 does not look up inode… CVSS 3.1HIGH 8.1
  • TI-2020-05670 Avaya Product System Management Interface Cross-Site Request Forgery Vulnerability CVSS 3.1HIGH 8.8
  • TI-2018-11142 Communication Manager Denial of Service CVSS 3.0HIGH 7.5
  • TI-2016-04582 NULL pointer dereference in Mozilla Network Security Services CVSS 3.1HIGH 7.5
  • TI-2022-02074 Avaya Aura Communication Manager Privilege Escalation Vulnerabilities CVSS 3.1HIGH 7.7
  • TI-2010-02675 The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35… CVSS 3.1HIGH 7.8
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences