Mitel Product Security Advisory MISA-2026-0008
PHP Remote Code Execution (RCE) Vulnerability (php2shell, CVE-2026-109618, CVE-2026-109619)
Advisory ID: MISA-2026-0008
First Issue Date: 2026-10-22
Last Updated: 2026-10-23
Revision: 3.0
Summary
In October 2026, two Remote Code Execution (RCE) vulnerabilities in PHP were publicly disclosed.
A remote code execution vulnerability, CVE-2026-109618, has been identified in the out-of-memory (OOM) error handling component of the PHP scripting language interpreter, which if successfully exploited, could allow an unauthenticated remote attacker with network access to a PHP-served interface to conduct arbitrary code execution due to improperly controlled sequential memory allocation. The vulnerability severity is rated as critical, based on the assessment provided in the CVE record.
A remote code execution vulnerability, CVE-2026-109619, has been identified in the request state management component of the PHP scripting language interpreter, which if successfully exploited, could allow an unauthenticated remote attacker with network access to a PHP-served interface to conduct arbitrary code execution due to improper reset of global state referencing request memory. The vulnerability severity is rated as critical, based on the assessment provided in the CVE record.
Affected Products and Solutions
Mitel is actively investigating the impact of CVE-2026-109618 and CVE-2026-109619 on Mitel software and hardware appliances. Mitel will provide updates as more information becomes available.
Also, Mitel has investigated and where required updated all Mitel operated cloud SaaS services. Specifically, Unify Phone and CloudLink services are not affected by these vulnerabilities
Product statements are related only to supported product versions. Products which have reached End of Support status are not considered.
This security advisory provides information on the following products:
Platforms, Solutions and Gateways:
| PRODUCT NAME | STATUS | VERSION(S) AFFECTED | SOLUTION(S) |
| Mitel Standard Linux | Not Affected | ||
| MiVoice 5000 | Affected | R8.4 and earlier | Security update available, see KB article: KB000128981 |
| MiVoice Border Gateway | Not Affected | ||
| MiVoice Business | Not Affected | ||
| MiVoice Business Solution Virtual Instance | Not Affected | ||
MiVoice Connect | Affected | R20.0 SP2 and earlier | See KB article KB000128981 |
| MiVoice MX-ONE | Not Affected | ||
MiVoice Office 400 | Not Affected | ||
| Mitel SMB Controller | Not Affected | ||
| Mitel AG41xx Analog Gateways | Investigating | ||
| Mitel EX Controller and Mitel GX Gateway | Investigating | ||
| OpenScape 4000 | Not Affected | ||
| OpenScape Branch | Affected | V11R3.4.3 and earlier | See KB article: KB000128997 |
| OpenScape Business | Not Affected | ||
| OpenScape SBC | Affected | V11R3.4.3 and earlier | See KB article: KB000128997 |
| OpenScape Voice Server | Not Affected | ||
| OpenScape Xpert | Not Affected |
Applications:
| PRODUCT NAME | STATUS | VERSION(S) AFFECTED | SOLUTION(S) |
Mitel Business Analytics | Not Affected | ||
Mitel Business CTI and Meta Directory | Not Affected | ||
Mitel Collaboration Management (CMG) | Affected | R9.4 SP1 and earlier | See KB article KB000128981 |
Mitel Virtual Reception | Not Affected | ||
OpenScape Backup and Recovery Services | Not Affected | ||
Mitel InAttend | Not Affected | ||
Mitel MiCollab | Not Affected | ||
MiCollab Advanced Messaging | Affected | 9.3 and earlier | See KB article: KB000128990 |
Mitel Performance Analytics | Not Affected | ||
Mitel Revolution | Not Affected | ||
Mitel Open Integration Gateway | Not Affected | ||
| MiCloud Management Portal | Not Affected | ||
OpenScape Accounting Management | Not Affected | ||
OpenScape Alarm Response | Not Affected | ||
OpenScape Common Management | Not Affected | ||
OpenScape Composer | Not Affected | ||
OpenScape Fault Management | Not Affected | ||
OpenScape UC Application | Not Affected | ||
| OpenScape Voice Trace Manager | Affected | V8 R0.12.00 and earlier |
Contact Centers:
| PRODUCT NAME | STATUS | VERSION(S) AFFECTED | SOLUTION(S) |
MiContact Center Business | Not Affected |
| |
Mitel CX | Not Affected |
| |
| Mitel CX Continuity | Not Affected | ||
MiContact Center Enterprise | Affected | 9.8 SP0 FP1 and earlier | See KB article: KB000128993 |
| MiContact Center High Availability | Not Affected | ||
MiContact Center Outbound | Not Affected |
| |
| Mitel Interaction Recording | Not Affected | ||
| Mitel Workforce Management | Not Affected | ||
OpenScape Concierge | Not Affected |
| |
OpenScape Contact Center | Not Affected |
| |
OpenScape Contact Media | Not Affected |
|
Devices:
| PRODUCT NAME | STATUS | VERSION(S) AFFECTED | SOLUTION(S) |
Mitel 6800/6900 IP Phone Series | Not Affected | ||
Mitel 5634 Wi-Fi Phone | Investigating | ||
Mitel IP-DECT | Investigating | ||
Mitel RFP12/RFP14 DECT | Investigating | ||
Mitel SIP DECT | Not Affected | ||
Mitel DECT Phones | Not Affected | ||
Mitel 700 DECT Handset | Not Affected | ||
Mitel TA7100 Series | Investigating | ||
OpenScape Cordless | Not Affected | ||
OpenScape DECT Phone | Investigating | ||
OpenScape Desk Phones CP | Not Affected | ||
OpenScape Endpoint Management | Not Affected | ||
OpenScape WLAN Phone | Investigating | ||
OpenScape Xpert Clients 6010P | Not Affected |
This section will be updated as Mitel’s investigation continues.
Vulnerability Severity
The vulnerability is rated as high severity, based on the assessment provided in the CVE record.
| CVE ID | SEVERITY | CVSS 3.1 BASE SCORE |
CVE-2026-109618 | Critical / 9.8 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CVE-2026-109619 | Critical / 9.8 | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Note: The impact on Mitel products has been reviewed and may differ from the original severity rating provided by the third party due to differences in product architecture and implementation.
Solution/ Recommended Action
Mitel is actively investigating the impact of CVE-2026-109618 and CVE-2026-109619 on our products and will provide updates as more information becomes available.
Please see Mitel Security Knowledge Base article KB000128981, PHP Remote Code Execution (RCE) Vulnerability "php2shell" (CVE-2026-109618, CVE-2026-109619).
If you do not have access to the Mitel Security Knowledge Base article, please contact your Mitel Authorized Partner for support.
For further information, please contact Mitel Product Support.
This advisory will be updated as further information is available.
References
CVE-2026-109618, CVE-2026-109619
Revision History
| Version | Date | Description |
|---|---|---|
| 1.0 | 2026-10-22 | Initial release |
| 2.0 | 2026-10-23 | Updated product status information for MiVoice 5000, MiVoice Office 400, Mitel Business Analytics, Mitel Virtual Reception, MiCollab Advanced Messaging, Mitel Revolution, Mitel CX Continuity, MiContact Center High Availability, MiContact Center Outbound, Mitel Interaction Recording, Mitel Workforce Management, Unify Phone and CloudLink. |
| 3.0 | 2026-10-23 | Updated product status information for MiVoice Connect, OpenScape Branch, OpenScape SBC, Mitel Business CTI and Meta Directory, Mitel Collaboration Management (CMG) and MiContact Center Enterprise. |
Publisher and Legal Disclaimer
Publisher: Mitel PSIRT / [email protected]
The information provided in this advisory is provided "as is" without warranty of any kind. The information is subject to change without notice. Mitel and its affiliates do not guarantee and accept no legal liability whatsoever arising from or connected to the accuracy, reliability, currency or completeness of the information provided. No part of this document can be reproduced or transmitted in any form or by any means - electronic or mechanical - for any purpose without written permission from Mitel Networks Corporation.