What We Do
How We Do
Get Started
Security advisories

Mitel Vulnerability Exploited 

March 10, 2022 | 1 MIN READ

Speak With A Security Expert Now



On March 8th, 2022, the Canadian Centre for Cyber Security (CCCS) disclosed ongoing attacks exploiting the Mitel vulnerability CVE-2022-26143 (CVSS:9.8). The vulnerability impacts the Mitel MiCollab and MiVoice Business Express products. Exploitation of CVE-2022-26143 allows remote and unauthenticated threat actors to gain initial access to victim devices, execute code, and perform Denial-of-Service (DoS) attacks.

Security patches are not available for CVE-2022-26143. Organizations using Mitel MiCollab and MiVoice Business Express are strongly encouraged to ensure devices are secured behind a firewall to minimize the likelihood of exploitation.

What we’re doing about it

What you should do about it

Additional information

CVE-2022-26143 was initially reported in February 2022; exploitation of the vulnerability has been ongoing since at least February 18th. Attacks in the wild are reported to have been performed in order to launch large scale Distributed Denial of Service (DDoS) attacks.

It should be noted that CVE-2022-26143 has alternatively been referred to as CVE-2022-26487. These CVS designations are duplicates and CVE-2022-26487 has been depreciated.

Impacted Products:


[1] https://cyber.gc.ca/en/alerts/mitel-security-advisory-av22-123
[2] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26143/
[3] https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0001
[4] https://mitel.custhelp.com/app/answers/answer_view/a_id/1017561 (Authentication Required)
[5] https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_22-0001-02-v1---mivbx.pdf
[6] https://blog.cloudflare.com/cve-2022-26143-amplification-attack/

View Most Recent Advisories