Mitel has 11 CVEs on record between 2022 and 2026. Disclosure cadence is accelerating: 8 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 8. The median CVSS is 8.4 (high), with 2 rated critical. 27% have been exploited in the wild — well above the 1% corpus average, so Mitel flaws are worth patching on sight. The median gap from publication to a KEV listing is 62 days (3 cases). The dominant weakness classes are CWE-22 (3) and CWE-31 (3). Most affected products: Mitel MiVoice Office 400 (8), micollab (2), mivoice_connect (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 27% vs 1% corpus
- Median CVSS
- 8.4
- Publish → KEV
- 62 d median(3)
- Last 90 days
- 8 prev 0
Products
- Mitel MiVoice Office 400 8
- micollab 2
- mivoice_connect 1
Worst active — by depth score
CVE-2024-41713Critical· 9.1A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation100CVE-2022-29499Critical· 9.8The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation95CVE-2024-55550Low· 2.7Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization52CVE-2026-104805High· 8.5DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specifi…47CVE-2026-104811High· 8.4DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product46
Mitel vulnerabilities
CVEs affecting Mitel, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-104807Low· 1.9DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the …
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the …
CVE-2026-104806Medium· 5.5DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management …
DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific flaw exists within the Maintenance → System Logs functionality of the web management …
CVE-2026-104805High· 8.5DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specifi…
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specifi…
CVE-2026-104706High· 8.4DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs
DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443 via menus Administration -> View Logs
CVE-2026-104808Low· 1.9DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web applica…
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web applica…
CVE-2026-104809High· 8.4DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the expected legitimate module. The loading mechanism relies on a predictable module name without…
CVE-2026-104810High· 8.4This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400
This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal li…
CVE-2026-104811High· 8.4DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists w…
CVE-2024-55550Low· 2.7CISA KEVPoCMitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization. A successful exploit could allow the authenticated admin attacker to…
CVE-2024-41713Critical· 9.1CISA KEVPoCA vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A succes…
CVE-2022-29499Critical· 9.8CISA KEVThe Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.