Threats / Mitel / CVE-2022-26143
CVE-2022-26143
· EUVD no mirror located
· GCVE no mirror located
Verified 2026-06-22
Mitel MiCollab, MiVoice Business Express vulnerability
CVE-2022-26143 is an authentication bypass vulnerability in Mitel MiCollab and MiVoice Business Express that allows unauthorized access to sensitive information and services, with potential for denial of service.
Verdict
Today item — known-exploited.
A missing or insufficient authentication control in Mitel collaboration products enables unauthenticated attackers to access protected resources and degrade system availability. Active exploitation in the wild indicates immediate risk.
01
Is it exploitable?
— the evidence, ranked above the scoreReported exploitation
4 independent public reports of in-the-wild exploitation are cataloged.Distinct reporting sources (vendor, incident response, government); open them for the underlying claims.
Exploited in the wild
Listed in the CISA Known Exploited Vulnerabilities catalog (added 2022-03-25).
Probability (EPSS)
EPSS 0.87565 — modeled likelihood of exploitation activity.EPSS is a daily-changing model output — open the source for today's value.
Severity / affected
Affected: Mitel, MiCollab, MiVoice Business Express. Confirm exact fixed builds in the vendor advisory.
Weakness (CWE)
Mapped to CWE-306 Missing Authentication, CWE-406 CWE-406 — weakness family: Authentication.CWE assignment from the public NVD record; the weakness class drives how the flaw is exploited.
02
Who’s exploiting it?
— attribution turns risk into urgencyAttribution not established
No confirmed (advisory-backed) threat-actor attribution is established for this record. Absence of a named actor is not absence of compromise — see Coverage & confidence.
03
Why it matters
— the attack path, told twice: adversary, then board1
Front door — unauthenticated access narrative 1
Attacker
I bypass authentication controls to access the affected system without valid credentials.
Business
Unauthorized actors gain entry to internal communication and collaboration infrastructure, exposing sensitive business conversations and data.
2
Keys to the kingdom — privilege/identity takeover narrative 2
Attacker
I extract or exfiltrate sensitive information from authenticated sessions and stored data.
Business
Confidential business communications, user credentials, and proprietary information are compromised, creating compliance violations and reputational damage.
3
Lateral reach — past segmentation narrative 3
Attacker
I trigger resource exhaustion or crash the service through malicious requests.
Business
Business continuity is disrupted as employees lose access to critical communication and collaboration tools, halting operations.
04
What to do
— defensible action- Remediate per the vendor advisory — confirm the fixed build for your version and verify exposure.1
Say it to the boardA vulnerability with this evidence profile is a defensible budget line, not a backlog ticket — fund the change against the proof above.
05