Mitel communication products face multiple privilege escalation flaws
Multiple privilege escalation vulnerabilities (CVE-2026-43284, CVE-2026-43500) affect numerous Mitel communication products across various versions requiring KB000127880 patch.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2026-43284 (weaponized) and CVE-2026-43500 (weaponized); no exploitation in the wild is recorded.
CERT-FR has published an advisory detailing multiple privilege escalation vulnerabilities affecting a broad range of Mitel unified communications and collaboration products. The vulnerabilities, tracked as CVE-2026-43284 and CVE-2026-43500, impact over 20 different Mitel product lines including MiCollab, MiVoice Business, OpenScape voice servers, and various telephony management systems. Affected versions span across multiple major releases, with many requiring the application of security patch KB000127880.
The vulnerabilities enable an attacker to elevate privileges on vulnerable systems, potentially allowing unauthorized administrative access to critical enterprise communication infrastructure. Products affected include cloud management portals, SIP-based telephony systems, border gateways, contact center platforms, and voice server solutions. Organizations using Mitel telecommunications infrastructure should prioritize patching efforts given the widespread nature of the affected product portfolio.
Mitel has released security advisory MISA-2026-0004 on May 28, 2026, providing remediation guidance and patches. Organizations should consult the vendor advisory to identify specific affected versions in their environment and obtain the appropriate security updates. The broad scope of affected products suggests this may represent a common code-base vulnerability impacting multiple Mitel product families.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0672
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs