ACTIVELY EXPLOITED
CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability
| Vendor | Mitel |
|---|---|
| Product | MiCollab, MiVoice Business Express |
| Actively exploited | Yes |
| Added to CISA KEV | 25 Mar 2022 |
| CISA federal deadline | 15 Apr 2022 |
| Weakness (CWE) | CWE-306, CWE-406 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
SOURCES
Other Mitel flaws
- CVE-2024-41710: Mitel SIP Phones Argument Injection Vulnerability
- CVE-2024-55550: Mitel MiCollab Path Traversal Vulnerability
- CVE-2024-41713: Mitel MiCollab Path Traversal Vulnerability
- CVE-2022-41223: Mitel MiVoice Connect Code Injection Vulnerability
- CVE-2022-40765: Mitel MiVoice Connect Command Injection Vulnerability
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.