Mitel MiCollab

product · product:mitel-micollab

Coverage

first 2026-07-24 → last 2026-07-24

Latest activity

2026-07-24

Mitel ships an out-of-band fix for an unauthenticated RCE in MiCollab's conferencing component, no CVE yet…

Peak priority

notable

1 notable

Targets

public-sector

sectors: public-sector, telco, healthcare · regions: europe

Sources cited

2 hosts

Action items (1)

Do-now tasks recorded on the entries about Mitel MiCollab, newest first. Check the date before acting on an older one.

Patch internet-facing Mitel MiCollab to 10.3.0.18, or apply the Mitel backport patches (KB000128275) for the 10.2 SP1 FP2 and 9.8 SP3 FP2 branches; the AWV command injection needs no authentication and no user interaction.
2026-07-24Mitel ships an out-of-band fix for an…

Defender insights

What each entry about Mitel MiCollab tells a defender to do, newest first.

2026-07-24NOTABLEMitel ships an out-of-band fix for an unauthenticated RCE in MiCollab's conferencing component, no CVE yet, exposed appliances first

Defender takeaway

MiCollab is a widely-deployed unified-communications and conferencing platform across European public-sector and enterprise voice estates, and its AWV component is frequently internet-exposed for external conferencing, exactly the surface that pre-auth command-injection targets. The absence of a CVE identifier is a tracking inconvenience, not a reason to defer: this is an out-of-band vendor advisory for an unauthenticated RCE on an appliance class with prior real-world exploitation (an earlier MiCollab unauthenticated RCE was exploited in the wild in 2025), so any internet-reachable AWV instance is a priority patch even before a public proof-of-concept or scanning appears. Where the patch cannot be applied immediately, restrict network reachability of the AWV conferencing interface to trusted networks and watch web/application access logs on that component for anomalous parameter values preceding process-execution telemetry (a web-tier process spawning a shell interpreter is the behavioural signature of successful command injection).

Story timeline

2026-07-24Mitel MiCollab AWV: unauthenticated command injection to full system compromise (CVSS 9.8, MTLVULN-1694, CVE pending)
trending-vulnerabilitiesMitel ships an out-of-band fix for an unauthenticated RCE in MiCollab's conferencing component, no CVE yet, exposed appliances first

Hunting pivots

Releases covered

Mitel MiCollab

Initial Access TA0001

T1190Exploit Public-Facing Application×1

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-07-24/mitel-micollab-awv-unauth-command-injection · ATT&CK page ↗

Entries about Mitel MiCollab (1)

2026-07-24 · view entry permalink →

NOTABLENATOA2

Mitel MiCollab AWV: unauthenticated command injection to full system compromise (CVSS 9.8, MTLVULN-1694, CVE pending)

Mitel's PSIRT advisory MISA-2026-0006 (2026-07-22, republished by CERT-FR as CERTFR-2026-AVI-0911 the next day) addresses a critical command-injection vulnerability, internally tracked as MTLVULN-1694 with a CVE requested but not yet assigned, in the Audio, Web, and Video Conferencing (AWV) component of on-premises MiCollab (Mitel, 2026-07-22). Per Mitel, insufficient parameter sanitisation in the AWV component lets an unauthenticated attacker inject and execute arbitrary OS commands, rated CVSS 3.1 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), meaning network-reachable, no credentials and no user interaction (Mitel, 2026-07-22). Affected releases run from 10.0.0.26 up to and including 10.2 SP1 FP2 (10.2.1.205) and 9.8 SP3 FP2 (9.8.3.203) and earlier; the fix ships in MiCollab 10.3.0.18, with Mitel-provided backport patches for the 10.2 SP1 FP2 and 9.8 SP3 FP2 branches (KB000128275) (CERT-FR, 2026-07-23). Neither Mitel nor CERT-FR reports exploitation at publication.

Defender takeaway

A command injection vulnerability has been identified in the Audio, Web, and Video Conferencing (AWV) component of Mitel MiCollab which, if successfully exploited, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization.

Note: The above issue is referenced here by our internal tracking ID. A CVE identifier has been requested but is not yet assigned.

Mitel PSIRT (MISA-2026-0006) 2026-07-22

vulnerability24 Jul 04:36Zmulti-sourceOpen finding →

Sources: Mitel PSIRT (MISA-2026-0006) · CERT-FR / ANSSI (CERTFR-2026-AVI-0911)

explore in graph

Where this entity is cited

Vulns1

Source distribution

cert.ssi.gouv.fr1 (50%)
mitel.com1 (50%)

All cited sources (2)