CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability

CVE-2022-26143 is an access-control weakness in Mitel MiCollab and MiVoice Business Express that can let an unauthenticated actor reach sensitive information and services, degrade performance, or cause a denial-of-service condition. These products are commonly used for unified communications, so exposure can affect both confidentiality of collaboration data and availability of voice and messaging services. Confirm exact impact and fixed releases against the vendor advisory.

How it works

The issue is tracked under CWE-306 (missing authentication for a critical function) and CWE-406 (insufficient control of network message volume). In products of this class, certain interfaces or services may accept requests without properly verifying the caller’s identity or may fail to limit how much traffic a single source can generate. An attacker who can reach the affected interface could therefore invoke functionality that should require authentication, obtain data or service access that was intended to be restricted, or flood the system in a way that slows or disrupts normal operation. Public detail on precise request formats or endpoints is limited; treat any internet-facing or poorly segmented MiCollab or MiVoice Business Express deployment as potentially reachable and verify behavior against Mitel’s advisory rather than assuming exploit mechanics.

Am I affected? How to find it in your systems

MiCollab and MiVoice Business Express typically run as on-premises or appliance-based unified-communications platforms, often integrated with telephony, directory, and collaboration services. Inventory steps:

• Search asset and CMDB records, hypervisor inventories, and network management tools for hosts or VMs labeled MiCollab, MiVoice Business Express, or related Mitel UC components.
• Scan internal and DMZ address space for management and service ports commonly used by Mitel UC products; confirm product identity via banners, certificates, or authenticated management consoles.
• Review version and build information reported by the product’s administration interface or support tools and compare it with the fixed versions listed in the vendor advisory—do not rely on version numbers stated elsewhere.
• Check network diagrams and firewall rules for any exposure of these systems to untrusted networks or broad internal segments.

For signs of exploitation, examine authentication and access logs for unexpected unauthenticated requests to administrative or service endpoints, sudden spikes in connection volume or resource use consistent with amplification or flooding, and anomalous access to sensitive configuration or user data. Correlate with IDS/IPS or NetFlow alerts around the time the vulnerability became widely known. Absence of clear indicators does not prove non-compromise; limited public telemetry signatures mean you should prioritize inventory and patching.

How to remediate

Apply the updates Mitel released for MiCollab and MiVoice Business Express exactly as described in the vendor advisory and CISA’s direction to apply updates per vendor instructions. After patching:

• Verify the installed version matches the remediated release and re-test previously exposed interfaces.
• Enforce authentication on all management and critical service endpoints; disable any unused services or legacy interfaces that do not require authentication.
• Apply rate limiting and connection controls at the application or reverse-proxy layer to reduce the risk of volume-based disruption (addressing the CWE-406 aspect).
• Restrict management access to dedicated administrative networks or jump hosts and require multi-factor authentication where supported.
• Re-validate network segmentation so that UC servers are not reachable from the open internet or from large untrusted internal populations.

If you can't patch immediately

Until the vendor update can be installed, reduce exposure with compensating controls:

• Block or tightly restrict external and unnecessary internal access to MiCollab and MiVoice Business Express management and service ports at the firewall; allow only known administrative sources.
• Place the systems behind a reverse proxy or WAF that can enforce authentication, geo or IP allow-lists, and rate limits; use virtual patching rules only if the vendor or a trusted security provider supplies signatures specific to this issue—confirm efficacy yourself.
• Disable non-essential features or listeners that the advisory or product documentation associates with unauthenticated access, if doing so does not break critical operations.
• Increase monitoring: alert on unauthenticated access attempts, unusual traffic volume, and performance degradation; retain packet captures or detailed logs for later analysis.
• Segment the UC environment so that compromise cannot easily pivot to directory, email, or core business systems.

These measures lower risk but do not replace the patch.

If your data may have been exposed

Actively exploited access-control flaws in communications platforms can lead to unauthorized disclosure of configuration data, user information, or service credentials and may be a precursor to broader intrusion. Known ransomware use of this CVE is not documented, yet any confirmed or suspected compromise should trigger your incident-response process: isolate affected hosts, preserve logs, rotate credentials that may have been accessible, and assess whether sensitive collaboration or directory data left the environment. As a simple additional check, you can run a free exposure scan of your email addresses against known breach datasets to see whether associated accounts appear in prior incidents.