CVE‑2022‑26143: Mitel MiCollab & MiVoice Business Express Access‑Control Vulnerability
What It Is – An access‑control flaw in Mitel’s MiCollab collaboration suite and MiVoice Business Express PBX may allow an unauthenticated attacker to read sensitive configuration data, disrupt services, or trigger a denial‑of‑service condition.
Exploitability – No public exploit code has been released, but the vulnerability is exploitable without valid credentials and has a CVSS v3.1 base score of 7.5 (High).
Affected Products – Mitel MiCollab (all supported versions) and Mitel MiVoice Business Express.
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – Continuous verification that only authorized identities can reach telephony and collaboration services is a core control that underpins audit readiness across frameworks.
- Evidence of due‑diligence – Demonstrating timely patching and configuration hardening provides defensible evidence for regulators and enterprise buyers demanding a trusted supply‑chain posture.
- Defensible audit trail – Logging of privileged‑access attempts and remediation actions creates a traceable record that can be presented during SOC 2, ISO 27001, or NIST CSF assessments.
Recommended Actions
- Apply Mitel’s security patch immediately (refer to the vendor advisory).
- Validate access‑control policies – confirm that only required service accounts have privileged rights on MiCollab/MiVoice components.
- Enable and review audit logs for authentication events, configuration changes, and any anomalous traffic.
- Incorporate the patch‑status into your continuous control‑monitoring platform to surface any future regressions.
Source: CISA KEV – CVE‑2022‑26143