Mitel Product Security Advisory MISA-2026-0010
Brotli Decoder Out-of-bounds Write Vulnerability (node2shell, CVE-2026-111497)
Advisory ID: MISA-2026-0010
First Issue Date: 2026-10-28
Last Updated: 2026-10-28
Revision: 1.0
Summary
In October 2026, an out-of-bounds write vulnerability in the Google Brotli decoder library was publicly disclosed.
An Out-of-bounds Write Vulnerability, CVE-2026-111497, has been identified in the Google Brotli decoder library, which if successfully exploited, could allow an unauthenticated attacker to conduct a denial-of-service attack and potentially disclose sensitive information or execute arbitrary code due to improper handling of malformed compressed data. The vulnerability severity is rated as high (CVSS 3.1), based on the publicly available information regarding the vulnerability and its potential impact.
Affected Products and Solutions
Mitel is actively investigating the impact of CVE-2026-111497 on Mitel software and hardware appliances. Mitel will provide updates as more information becomes available.
Mitel is investigating all Mitel operated cloud SaaS services and will apply updates as required. Specifically, Unify Phone and CloudLink updates have been applied to address these issues.
Product statements are related only to supported product versions. Products which have reached End of Support status are not considered.
This security advisory provides information on the following products:
Platforms, Solutions and Gateways:
PRODUCT NAME | STATUS | VERSION(S) AFFECTED | SOLUTION(S) |
Mitel Standard Linux | Not Affected |
|
|
Mitel SMB Controller | Not Affected |
|
|
MiVoice 5000 | Not Affected |
|
|
MiVoice 5000 Gateways XL XS XD | Not Affected |
|
|
MiVoice Border Gateway | Investigating |
|
|
MiVoice Business | Investigating |
|
|
MiVoice Business Solution Virtual Instance | Investigating |
|
|
MiVoice Connect | Investigating |
|
|
MiVoice MX-ONE | Investigating |
|
|
MiVoice Office 400 | Investigating |
|
|
OpenScape 4000 | Not Affected |
|
|
OpenScape Branch | Not Affected |
|
|
OpenScape Business | Investigating |
|
|
OpenScape SBC | Investigating |
|
|
OpenScape Voice Server | Investigating |
|
|
OpenScape Xpert | Investigating |
|
|
Mitel AG41xxAnalog Gateways | Investigating |
|
|
Mitel EX Controller and Mitel GX Gateway | Investigating |
|
|
Applications:
PRODUCT NAME | STATUS | VERSION(S) AFFECTED | SOLUTION(S) |
MiCollab | Investigating |
|
|
MiCollab Advanced Messaging | Investigating |
|
|
Mitel Alarm Server | Not Affected |
|
|
Mitel Business Analytics | Investigating |
|
|
Mitel Business CTI and Meta Directory | Investigating |
|
|
Mitel Collaboration Management (CMG) | Investigating |
|
|
Mitel Virtual Reception | Investigating |
|
|
Mitel InAttend | Investigating |
|
|
Mitel Performance Analytics | Investigating |
|
|
Mitel Revolution | Investigating |
|
|
Mitel Open Integration Gateway | Not Affected |
|
|
MiCloud Management Portal | Investigating |
|
|
OpenScape Accounting Management | Investigating |
|
|
OpenScape Alarm Response | Investigating |
|
|
OpenScape Backup and Recovery Services | Investigating |
|
|
OpenScape Common Management Platform | Investigating |
|
|
OpenScape Composer | Investigating |
|
|
OpenScape Fault Management | Investigating |
|
|
OpenScape SESAP | Investigating |
|
|
OpenScape UC Application | Investigating |
|
|
OpenScape Voice Trace Manager | Investigating |
|
|
OpenScape Xpressions | Investigating |
|
|
Contact Centers:
PRODUCT NAME | STATUS | VERSION(S) AFFECTED | SOLUTION(S) |
MiContact Center Business | Investigating |
|
|
Mitel CX | Investigating |
|
|
Mitel CX Continuity | Investigating |
|
|
MiContact Center Enterprise | Investigating |
|
|
MiContact Center High Availability | Investigating |
|
|
MiContact Center Outbound | Investigating |
|
|
Mitel Interaction Recording | Investigating |
|
|
Mitel Workforce Management | Investigating |
|
|
OpenScape Concierge | Investigating |
|
|
OpenScape Contact Center | Investigating |
|
|
OpenScape Contact Media Service | Investigating |
|
|
Devices:
PRODUCT NAME | STATUS | VERSION(S) AFFECTED | SOLUTION(S) |
Mitel 6800/6900 IP Phone Series | Investigating |
|
|
Mitel 5634 Wi-Fi Phone | Investigating |
|
|
Mitel IP-DECT | Investigating |
|
|
Mitel RFP12/RFP14 DECT | Investigating |
|
|
Mitel SIP DECT | Investigating |
|
|
Mitel DECT Phones | Investigating |
|
|
Mitel 700 DECT Handset | Investigating |
|
|
Mitel TA7100 Series | Investigating |
|
|
OpenScape Cordless Enterprise | Not Affected |
|
|
OpenScape Cordless IP | Investigating |
|
|
OpenScape DECT Phone | Investigating |
|
|
OpenScape Desk Phones CP | Investigating |
|
|
OpenScape Deployment Service | Investigating |
|
|
OpenScape Desk Phones CP | Investigating |
|
|
OpenScape Endpoint Management 1 | Affected | V1 R2.5.1 and earlier | Planned Update |
OpenScape WLAN Phone | Investigating |
|
|
OpenScape Xpert Clients 6010P | Investigating |
|
|
Note 1 : Mitel product specific assessment, risk rated as low when deployed according to Mitel recommended guidelines.
This section will be updated as Mitel’s investigation continues.
Vulnerability Severity
The vulnerability is rated as high severity, based on the publicly available information regarding the vulnerability and its potential impact.
CVE ID | SEVERITY | CVSS 3.1 BASE SCORE |
CVE-2026-111497 | High / 8.1 | AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Note: The impact on Mitel products is being reviewed and may differ from the original severity rating provided by the third party due to differences in product architecture and implementation.
Solution/ Recommended Action
Mitel is actively investigating the impact of CVE-2026-111497 on our products and will provide updates as more information becomes available.
Please see Mitel Security Knowledge Base article KB000129034, Brotli Decoder Out-of-bounds Write Vulnerability "Node2Shell" (CVE-2026-111497).
If you do not have access to the Mitel Security Knowledge Base article links, please contact your Mitel Authorized Partner for support.
For further information, please contact Mitel Product Support.
This advisory will be updated as further information is available.
References
CVE-2026-111497
Revision History
| Version | Date | Description |
|---|---|---|
| 1.0 | 2026-10-28 | Initial release |
Publisher and Legal Disclaimer
Publisher: Mitel PSIRT / [email protected]
The information provided in this advisory is provided "as is" without warranty of any kind. The information is subject to change without notice. Mitel and its affiliates do not guarantee and accept no legal liability whatsoever arising from or connected to the accuracy, reliability, currency or completeness of the information provided. No part of this document can be reproduced or transmitted in any form or by any means - electronic or mechanical - for any purpose without written permission from Mitel Networks Corporation.