VORANT. Threat Intelligence Sign in Get the full feed

Mitel MiCollab, MiVB SVI flaws enable RCE

high vulnerability telecommunications

Multiple vulnerabilities in Mitel MiCollab and MiVoice Business solutions allow remote code execution, data exfiltration, and security bypass.

The French CERT has issued an advisory for multiple vulnerabilities affecting Mitel's MiCollab collaboration platform and MiVoice Business Solution Virtual Instance (MiVB SVI). The flaws span several attack classes including remote code execution, SQL injection, server-side request forgery, and security policy bypass. Affected versions include MiCollab 10.2.x prior to 10.2 SP1 FP2 (10.2.1.205), MiCollab 9.8.x prior to 9.8 SP3 FP2 (9.8.3.203), MiVB SVI 1.0 without recent security patches, and MiVB SVI 2.x prior to 2.1.0.9-4.

The combination of vulnerabilities could allow an attacker to achieve remote code execution, compromise data confidentiality and integrity, inject malicious SQL queries, and perform server-side request forgery attacks. Organizations using Mitel's collaboration and voice solutions should apply the patches referenced in Mitel's security advisory MISA-2026-0005 released on June 17, 2026. The advisory specifically highlights risks to data integrity, data confidentiality, security policy enforcement, and the potential for arbitrary remote code execution.

Detection guidance

Command Interpreter Spawned by Web/Application Server Process (Possible Mitel MiCollab/MiVB Exploitation)

ATT&CK T1059

Detects a shell or scripting interpreter being spawned as a child of a web/application server process, consistent with post-exploitation of a web-facing RCE such as the Mitel MiCollab/MiVB SVI flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shell Spawned by Web Application Server Process
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /tomcat
    - /java
    - /httpd
    - /apache2
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /perl
    - /python
    - /python3
  filter_known_ops:
    CommandLine|contains:
    - logrotate
    - healthcheck
  condition: selection_parent and selection_child and not filter_known_ops
falsepositives:
- Legitimate administrative scripts invoked by application server for maintenance
  or health checks
- Custom deployment or backup scripts executed by the web service account
level: high
tags:
- attack.t1059
- attack.t1190
id: 646b4fbc-b6e3-5126-8719-364e4c36f3f8
status: experimental
author: Vorant

Web Shell File Written to Web-Accessible Directory by Server Process

ATT&CK T1505.003

Detects creation of script/executable files within web-accessible directories by a web or application server process, indicating possible web shell deployment following exploitation of a public-facing application such as Mitel MiCollab/MiVB SVI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Script File Dropped in Web Directory by Server Process
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
    - /webapps/
    - /htdocs/
    - /www/
    - /webroot/
  selection_ext:
    TargetFilename|endswith:
    - .jsp
    - .php
    - .war
    - .sh
    - .jspx
  selection_proc:
    Image|contains:
    - /tomcat
    - /java
    - /httpd
    - /apache2
  condition: selection_path and selection_ext and selection_proc
falsepositives:
- Legitimate application deployment or update pushing new web archive files
- Automated CMS or plugin updates writing new script files
level: high
tags:
- attack.t1505.003
- attack.t1190
id: e6f25adf-218d-5a81-a336-794267b497b4
status: experimental
author: Vorant

Reconnaissance Commands Executed by Web/Application Server Process

ATT&CK T1059

Detects common reconnaissance commands (id, whoami, uname, cat /etc/passwd) executed as children of a web/application server process, a typical indicator of successful remote code execution against a public-facing application like Mitel MiCollab/MiVB SVI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Recon Commands Executed via Web Application Process
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /tomcat
    - /java
    - /httpd
    - /apache2
    - /nginx
  selection_cmd:
    CommandLine|contains:
    - whoami
    - id -a
    - uname -a
    - /etc/passwd
    - cat /etc/shadow
  condition: selection_parent and selection_cmd
falsepositives:
- Health-check or diagnostic scripts that call whoami/uname for logging purposes
level: medium
tags:
- attack.t1059
- attack.t1190
id: 0e67dad8-5134-5963-8f76-c9eb95a4f2af
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0770/

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free