Mitel Product Security Advisory MISA-2026-0011

An unauthorized access vulnerability, MTLVULN-1858, has been identified in the Provisioning Manager component of MiVoice MX-ONE, which, if successfully exploited, could allow an authenticated attacker to conduct an information disclosure attack due to improper authorization controls. A successful exploit of this vulnerability could allow an authenticated attacker, with any privilege level and internal LAN network access, to obtain system configuration data. The vulnerability severity is rated as medium.

A command injection vulnerability, MTLVULN-1859, has been identified in the Service Node Manager component of MiVoice MX-ONE, which, if successfully exploited, could allow an authenticated attacker with administrative privileges to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit of this vulnerability requires administrative privileges and could allow an attacker with LAN network access to execute arbitrary operating system commands within the context of the system with the privileges of the management service account. This could enable an attacker to view sensitive configuration data, alter system settings, or disrupt telephony management services. The vulnerability severity is rated as high.

An authentication bypass vulnerability, MTLVULN-1860, has been identified in the Service Node Manager component of MiVoice MX-ONE, which, if successfully exploited, could allow an unauthenticated attacker with LAN network access to conduct an unauthorized access attack due to improper authentication controls. A successful exploit of this vulnerability could allow an attacker to gain unauthorized administrative access and view and modify PBX telephony routing and service configuration. The vulnerability severity is rated as critical.

Exploiting these vulnerabilities together can significantly amplify their impact, potentially resulting in a critical severity.

Mitel is recommending customers with affected product versions apply the fixes in the highlighted solution. 

This security advisory provides information on the following products:

Product statements are related only to supported product versions. Products that have reached End of Support status are not considered.

The following products have been identified as affected:

The identified vulnerabilities carry varied levels of severity, ranging from critical to moderate.

Note: The above issue is referenced here by our internal tracking ID. A CVE identifier has been requested but is not yet assigned.

Mitel has provided Hot Fixes MX-ONE PM/SNM 8.2 SP0 HF5 and 8.2 SP1 HF2, or later, that address these vulnerabilities. Upgrade to one of these releases and apply the provided hotfix, or upgrade to a later release.

These issues are corrected in MiVoice MX-ONE version 8.3. Customers are advised to upgrade to this or subsequent releases when available.

Please see Mitel Knowledge Base article KB000129185, “MiVoice MX-ONE Security Update, MTLVULN-1858, MTLVULN-1859, MTLVULN-1860”.

If you do not have access to this link, please contact your Mitel Authorized Partner for support.

For further information, please contact Mitel Product Support.