CVE-2022-26143VulnerabilityPublished 03/25/2022Updated 10/24/2026

CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability

Affects Mitel MiCollab, MiVoice Business ExpressSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 03/25/2022
KEV deadline: 04/15/2022
EPSS: 87.3% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2022-26143 (opens in a new tab)

Description

CVE-2022-26143 is a high-severity vulnerability affecting Mitel's MiCollab and MiVoice Business Express products. It allows a malicious actor to gain unauthorized access to sensitive information and services, and may cause performance degradation or denial of service on the affected systems. The vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Summary

CVE-2022-26143 is an access control vulnerability in Mitel's MiCollab and MiVoice Business Express products. This flaw enables attackers to bypass access controls, potentially leading to unauthorized access to sensitive data and services, as well as causing performance issues or denial of service conditions. The vulnerability is associated with CWE-306 (Missing Authentication for Critical Function) and CWE-406 (Insufficient Control of Network Message Volume). Exploitation has been observed in the wild, indicating active threat usage. No vendor advisory or patch information is available in the provided data.

Impact

Successful exploitation can result in unauthorized access to sensitive information and services, as well as performance degradation or denial of service on affected systems. The vulnerability has been exploited in the wild, confirming its practical impact and risk to affected organizations.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should monitor vendor communications for updates and consider implementing compensating controls specific to access control and service availability as appropriate.

CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability

What to do

Description

Summary

Impact

Mitigation

Weaknesses

References

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:11:07 UTC

Weaknesses

References

Related threats