Mitel flaws being used in attacks

CISA lists 7 flaws in Mitel products as being used in attacks, most recently on 12 Feb 2025. 5 have been used in ransomware.

What to do

1. Update every Mitel product you use.Install the updates Mitel offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
2. If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
3. Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.

Every flaw, newest first

1. Being used in attacksAdded by CISA on 12 Feb 2025
   Mitel SIP Phones
   CVE-2024-41710Mitel SIP Phones Argument Injection Vulnerability
   Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
2. Being used in attacksUsed in ransomwareAdded by CISA on 7 Jan 2025
   Mitel MiCollab
   CVE-2024-55550Mitel MiCollab Path Traversal Vulnerability
   Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
3. Being used in attacksUsed in ransomwareAdded by CISA on 7 Jan 2025
   Mitel MiCollab
   CVE-2024-41713Mitel MiCollab Path Traversal Vulnerability
   Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server.
   CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
   CVE recordNVD
4. Being used in attacksUsed in ransomwareAdded by CISA on 21 Feb 2023
   Mitel MiVoice Connect
   CVE-2022-41223Mitel MiVoice Connect Code Injection Vulnerability
   The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
5. Being used in attacksUsed in ransomwareAdded by CISA on 21 Feb 2023
   Mitel MiVoice Connect
   CVE-2022-40765Mitel MiVoice Connect Command Injection Vulnerability
   The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
6. Being used in attacksUsed in ransomwareAdded by CISA on 27 Jun 2022
   Mitel MiVoice Connect
   CVE-2022-29499Mitel MiVoice Connect Data Validation Vulnerability
   The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD
7. Being used in attacksAdded by CISA on 25 Mar 2022
   Mitel MiCollab, MiVoice Business Express
   CVE-2022-26143MiCollab, MiVoice Business Express Access Control Vulnerability
   A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system.
   CISA’s required actionApply updates per vendor instructions.
   CVE recordNVD

From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Mitel on CISA’s site.