Mitel Product Security Advisory MISA-2026-0005

This security advisory addresses multiple vulnerabilities identified in MiCollab:

A command injection vulnerability, MTLVULN-1667, has been identified in the MiCollab Client Service component of Mitel MiCollab and MiVoice Business Solution Virtual Instance (MiVB SVI) which, if successfully exploited, could allow an unauthenticated attacker to conduct a command injection attack due to improper certificate validation. A successful exploit of this vulnerability could allow an attacker to execute arbitrary commands within the context of the system. The vulnerability severity is rated as Critical.
Credit is given to Mustafa Can Ipekci of Synack Red Team for highlighting these issues and bringing them to our attention.

A command injection vulnerability, MTLVULN-1666, has been identified in the Feedback Module of the MiCollab Client Service component of Mitel MiCollab and MiVoice Business Solution Virtual Instance (MiVB SVI) which, if successfully exploited, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit of this vulnerability could allow an attacker to execute arbitrary commands within the context of the system. The vulnerability severity is rated as Critical.
Credit is given to Mustafa Can Ipekci of Synack Red Team for highlighting these issues and bringing them to our attention.

A command injection vulnerability, MTLVULN-1669, has been identified in the MiCollab Client Service component of Mitel MiCollab and MiVoice Business Solution Virtual Instance (MiVB SVI) which, if successfully exploited, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit of this vulnerability could allow an attacker to execute arbitrary commands within the context of the system. The vulnerability severity is rated as Critical.

A missing authorization vulnerability, MTLVULN-1668, has been identified in the MiCollab Client Service component of Mitel MiCollab and MiVoice Business Solution Virtual Instance (MiVB SVI) which, if successfully exploited, could allow an unauthenticated attacker to conduct an unauthorized access attack due to missing authentication mechanisms. A successful exploit of this vulnerability could allow an attacker  to view, corrupt, or delete system configurations. The vulnerability severity is rated as Critical.

A server-side request forgery (SSRF) vulnerability, MTLVULN-1641, has been identified in the MiCollab Client Service component of Mitel MiCollab and MiVoice Business Solution Virtual Instance (MiVB SVI) which, if successfully exploited, could allow an unauthenticated attacker to conduct an SSRF attack due to insufficient restriction of user-provided URLs. A successful exploit of this vulnerability could allow an attacker to leverage connections and permissions available to the host server. The vulnerability severity is rated as Critical.
Credit is given to Mustafa Can Ipekci of Synack Red Team for highlighting these issues and bringing them to our attention.

An SQL injection vulnerability, MTLVULN-1665, has been identified in the MiCollab Client Service component of Mitel MiCollab and MiVoice Business Solution Virtual Instance (MiVB SVI) which, if successfully exploited, could allow an unauthenticated attacker to conduct an SQL Injection attack due to insufficient validation of user input. A successful exploit of this vulnerability could allow an attacker to execute arbitrary SQL database commands. The vulnerability severity is rated as Critical.
Credit is given to Mustafa Can Ipekci of Synack Red Team for highlighting these issues and bringing them to our attention.

A command injection vulnerability, MTLVULN-1631 has been identified in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab which, if successfully exploited, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit of this vulnerability could allow an attacker to execute arbitrary commands within the context of the system. The vulnerability severity is rated as Critical.
Credit is given to Mustafa Can Ipekci of Synack Red Team for highlighting these issues and bringing them to our attention.

A command injection vulnerability, MTLVULN-1672, has been identified in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab which, if successfully exploited, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit of this vulnerability could allow an attacker to execute arbitrary commands within the context of the system. The vulnerability severity is rated as Critical.
Credit is given to Phuoc Pham and Dung Pham, independent security researchers, for highlighting these issues and bringing them to our attention.

An unauthorized file write vulnerability, MTLVULN-1633, has been identified in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab which, if successfully exploited, could allow an unauthenticated attacker to conduct an unauthorized write to arbitrary files with malicious contents due to lack of path sanitization. A successful exploit of this vulnerability could allow an attacker to execute arbitrary code. The vulnerability severity is rated as Critical.
Credit is given to Mustafa Can Ipekci of Synack Red Team for highlighting these issues and bringing them to our attention.

An arbitrary file upload vulnerability, MTLVULN-1632, has been identified in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab which, if successfully exploited, could allow an unauthenticated attacker to upload arbitrary files with malicious contents due to missing authentication mechanisms, insufficient file content sanitization, and lack of file type validation. A successful exploit of this vulnerability could allow an attacker to upload arbitrary files with malicious content. The vulnerability severity is rated as Critical.
Credit is given to Mustafa Can Ipekci of Synack Red Team for highlighting these issues and bringing them to our attention.

An XML external entity (XXE) injection vulnerability, MTLVULN-1664, has been identified in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab which, if successfully exploited, could allow an unauthenticated attacker to conduct unauthorized read access to local files on the MiCollab server due to the XML parser allowing external entities. A successful exploit of this vulnerability could allow an attacker to obtain unauthorized access to arbitrary files. The vulnerability severity is rated as High.
Credit is given to Mustafa Can Ipekci of Synack Red Team for highlighting these issues and bringing them to our attention.

An SQL injection vulnerability, MTLVULN-1640, has been identified in the Audio, Web, and Video Conferencing (AWV) component of Mitel MiCollab which, if successfully exploited, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient validation of user input. A successful exploit of this vulnerability could allow an attacker to execute arbitrary SQL database commands. The vulnerability severity is rated as Critical.
Credit is given to Mustafa Can Ipekci of Synack Red Team for highlighting these issues and bringing them to our attention.

Mitel is recommending customers with affected product versions update to the available solutions as soon as feasible.
 

Affected Products and Solutions