SECURITY ADVISORIES
Mitel Product Security Advisories are published for moderate and high-risk security issues. Each advisory provides information on the status of investigation and provides additional information on products confirmed to be affected and recommended action to be taken by customers. Advisories are posted in reverse chronological order.
This information is provided on an "as is" basis and does not grant or imply any guarantees or warranties, including the warranties of merchantability or fitness for a particular use. Mitel does not guarantee that any of the information is accurate or up to date. By using the information, you acknowledge and agree that your use of the information, or the documents or materials linked to this information, is at your own risk. In addition, Mitel’s provision of this information shall not and does not affect the terms or conditions of any agreement with Mitel. Mitel reserves the right to change or update this information without notice at any time.
Click here for a more comprehensive details on Mitel’s Product Security Policy ›
| Advisory ID | CVE# | [Severity](/content/support/security-advisories?order=field_severity&sort=asc "sort by Severity"/index.html) | [Publish Date](/content/support/security-advisories?order=created&sort=asc "sort by Publish Date"/index.html) | [Last Updated<br> Sort ascending](/content/support/security-advisories?order=field_date&sort=asc "sort by Last Updated"/index.html) | |
|---|---|---|---|---|---|
| Linux Kernel Local Privilege Escalation Vulnerabilities "Dirty Frag" (CVE-2026-43284, CVE-2026-43500) | MISA-2026-0004 | CVE-2026-43284, CVE-2026-43500 | high | 2026-05-28 | 2026-05-28 |
| Linux Kernel Local Privilege Escalation Vulnerability (Copy Fail, CVE-2026-31431) | MISA-2026-0003 | CVE-2026-31431 | high | 2026-05-07 | 2026-05-21 |
| MiCollab SQL Injection and Privilege Escalation Vulnerabilities | MISA-2026-0002 | CVE requested | critical | 2026-04-08 | 2026-04-08 |
| MiContact Center Business and Mitel CX Reflected Cross Site Scripting (XSS) Vulnerability | MISA-2026-0001 | CVE requested | high | 2026-03-18 | 2026-03-18 |
| MiContact Center Business and Mitel CX Cross Site Scripting (XSS) Vulnerability | MISA-2025-0010 | CVE-2025-67823 | high | 2025-12-09 | 2026-01-10 |
| MiVoice MX-ONE Authentication Bypass Vulnerability | MISA-2025-0009 | CVE-2025-67822 | critical | 2025-07-23 | 2026-01-05 |
| MiCollab SQL injection Vulnerability | MISA-2025-0008 | CVE-2025-52914 | high | 2025-07-23 | 2025-08-06 |
| Mitel 6800 Series, 6900 Series and 6900w Series SIP Phones, including 6970 Conference Unit Command Injection and Unauthenticated File Upload Vulnerabilities | MISA-2025-0004 | CVE-2025-47188, CVE-2025-47187 | critical | 2025-05-06 | 2025-06-26 |
| MiCollab Path Traversal Vulnerability | MISA-2025-0007 | CVE-2025-52913 | critical | 2025-06-11 | 2025-06-24 |
| MiContact Center Business Reflected Cross Site Scripting Vulnerability | MISA-2025-0003 | CVE-2025-27828 | high | 2025-03-26 | 2025-06-18 |
| OpenScape Accounting Management Path Traversal Vulnerability | MISA-2025-0006 | CVE-2025-23092 | high | 2025-06-11 | 2025-06-03 |
| OpenScape Xpressions Path Traversal Vulnerability | MISA-2025-0005 | CVE-2025-48026 | high | 2025-05-21 | 2025-05-21 |
| MiContact Center Business Information Disclosure Vulnerability | MISA-2025-0002 | CVE-2025-27827 | high | 2025-01-22 | 2025-03-11 |
| OpenScape 4000 and OpenScape 4000 Manager Privilege Escalation and Command Injection Vulnerabilities | MISA-2025-0001 | CVE-2025-23093, CVE-2025-23094 | high | 2025-01-22 | 2025-02-13 |
| MiCollab Path Traversal Vulnerability | MISA-2024-0029 | CVE-2024-41713, CVE-2024-5555 | critical | 2024-10-09 | 2024-12-12 |
| MiCollab Argument Injection Vulnerability | 24-0015 | CVE-2024-35314 | high | 2024-05-23 | 2024-11-06 |
| MiCollab CRLF Injection Vulnerability | MISA-2024-0025 | CVE-2024-47224 | medium | 2024-10-09 | 2024-10-09 |
| MiCollab Authentication Bypass Vulnerability | MISA-2024-0027 | CVE-2024-47912 | high | 2024-10-09 | 2024-10-09 |
| MiCollab SQL Injection Vulnerability | MISA-2024-0028 | CVE-2024-47223 | critical | 2024-10-09 | 2024-10-09 |
| MiCollab SQL Injection Vulnerability in the API Interface | MISA-2024-0026 | CVE-2024-47189 | high | 2024-10-09 | 2024-10-09 |
| MiContact Center Business Unauthorized Access Vulnerability | 24-0024 | CVE-2024-42514 | high | 2024-08-21 | 2024-10-02 |
| OpenScape Voice Path Traversal vulnerability | CVE-2023-48166 | CVE-2023-48166 | high | 2024-10-01 | 2024-10-01 |
| OpenScape 4000 and OpenScape 4000 Manager Command Injection Vulnerability in the Platform Webservice | OBSO-2407-02 | critical | 2025-03-19 | 2024-09-25 | |
| OpenScape Business Sensitive Information Disclosure Vulnerability | OBSO-2408-01 | medium | 2024-08-14 | 2024-08-14 | |
| MiCollab Command Injection Vulnerability | 24-0021 | CVE-2024-41714 | critical | 2024-07-24 | 2024-08-13 |
| Mitel 6800 Series, 6900 Series and 6900w Series SIP Phones, including 6970 Conference Unit Command Injection in the Boot Process | 24-0019 | CVE-2024-41710 | high | 2024-07-17 | 2024-07-30 |
| Mitel 6800 Series, 6900 Series and 6900w Series SIP Phones, including 6970 Conference Unit Command Injection | 24-0020 | CVE-2024-41711 | medium | 2024-07-17 | 2024-07-30 |
| MiCollab Command Injection Vulnerability in the Web Conferencing Component | 24-0022 | CVE-2024-41712 | high | 2024-07-24 | 2024-07-24 |
| MiCollab Privilege Escalation Vulnerability | 24-0023 | CVE-2024-35287 | high | 2024-07-24 | 2024-07-24 |
| OpenScape 4000 Assistant and OpenScape 4000 Manager Command Injection Vulnerability | OBSO-2407-03 | critical | 2025-03-19 | 2024-07-17 |