Mitel vulnerabilities
We track 46 vulnerabilities in Mitel products across 40 products. 43 are rated high or critical, and 8 have been exploited in real attacks. The most recent was published on October 5, 2026.
Latest Mitel vulnerabilities
- 8.8 High severity
Micollab: Improper Authorization
A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to improper authorization controls. A successful exploit could allow the authenticated attacker to
- 8.8 High severity
Micollab: Server-Side Request Forgery
A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Request Forgery (SSRF) attack due to insufficient restriction of URL parameters. A successful exploit cou
- 9.8 Critical severity
Mivoice Business: Buffer Copy without Checking Size of Input
A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to the management interface) to conduct a buffer overflow attack d
- 9.8 Critical severity
Mitel MiVoice Connect Data Validation Exploited
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
- 9.8 Critical severity
MiCollab, MiVoice Business Express Access Control Exploited
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). Th
- 7.5 High severity
OpenSSL Information Disclosure Exploited
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, a