VORANT. Threat Intelligence Research Create a free account

Mitel MiCollab, MiVB SVI flaws enable RCE

Published Vorant ratingroutine vulnerability Telecommunications

Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

Multiple vulnerabilities in Mitel MiCollab and MiVoice Business solutions allow remote code execution, data exfiltration, and security bypass.

Sourcecert.ssi.gouv.fr — open the original

What to check

Applies to
Whether this concerns you is not assessed; the names the report mentions are listed below.

The French CERT has issued an advisory for multiple vulnerabilities affecting Mitel's MiCollab collaboration platform and MiVoice Business Solution Virtual Instance (MiVB SVI). The flaws span several attack classes including remote code execution, SQL injection, server-side request forgery, and security policy bypass. Affected versions include MiCollab 10.2.x prior to 10.2 SP1 FP2 (10.2.1.205), MiCollab 9.8.x prior to 9.8 SP3 FP2 (9.8.3.203), MiVB SVI 1.0 without recent security patches, and MiVB SVI 2.x prior to 2.1.0.9-4.

The combination of vulnerabilities could allow an attacker to achieve remote code execution, compromise data confidentiality and integrity, inject malicious SQL queries, and perform server-side request forgery attacks. Organizations using Mitel's collaboration and voice solutions should apply the patches referenced in Mitel's security advisory MISA-2026-0005 released on June 17, 2026. The advisory specifically highlights risks to data integrity, data confidentiality, security policy enforcement, and the potential for arbitrary remote code execution.

Related reporting

Detection guidance

Command Interpreter Spawned by Web/Application Server Process (Possible Mitel MiCollab/MiVB Exploitation)

ATT&CK T1059 · status experimental · needs linux process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects a shell or scripting interpreter being spawned as a child of a web/application server process, consistent with post-exploitation of a web-facing RCE such as the Mitel MiCollab/MiVB SVI flaws. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Shell Spawned by Web Application Server Process
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /tomcat
    - /java
    - /httpd
    - /apache2
    - /nginx
  selection_child:
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /perl
    - /python
    - /python3
  filter_known_ops:
    CommandLine|contains:
    - logrotate
    - healthcheck
  condition: selection_parent and selection_child and not filter_known_ops
falsepositives:
- Legitimate administrative scripts invoked by application server for maintenance
  or health checks
- Custom deployment or backup scripts executed by the web service account
level: high
tags:
- attack.t1059
- attack.t1190
id: 646b4fbc-b6e3-5126-8719-364e4c36f3f8
status: experimental
author: Vorant

Web Shell File Written to Web-Accessible Directory by Server Process

ATT&CK T1505.003 · status experimental · needs linux file_event logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects creation of script/executable files within web-accessible directories by a web or application server process, indicating possible web shell deployment following exploitation of a public-facing application such as Mitel MiCollab/MiVB SVI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Script File Dropped in Web Directory by Server Process
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
    - /webapps/
    - /htdocs/
    - /www/
    - /webroot/
  selection_ext:
    TargetFilename|endswith:
    - .jsp
    - .php
    - .war
    - .sh
    - .jspx
  selection_proc:
    Image|contains:
    - /tomcat
    - /java
    - /httpd
    - /apache2
  condition: selection_path and selection_ext and selection_proc
falsepositives:
- Legitimate application deployment or update pushing new web archive files
- Automated CMS or plugin updates writing new script files
level: high
tags:
- attack.t1505.003
- attack.t1190
id: e6f25adf-218d-5a81-a336-794267b497b4
status: experimental
author: Vorant

Reconnaissance Commands Executed by Web/Application Server Process

ATT&CK T1059 · status experimental · needs linux process_creation logs · generated from the report, not run against telemetry

A behavioural hunt for the technique in general.

Detects common reconnaissance commands (id, whoami, uname, cat /etc/passwd) executed as children of a web/application server process, a typical indicator of successful remote code execution against a public-facing application like Mitel MiCollab/MiVB SVI. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Recon Commands Executed via Web Application Process
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
    - /tomcat
    - /java
    - /httpd
    - /apache2
    - /nginx
  selection_cmd:
    CommandLine|contains:
    - whoami
    - id -a
    - uname -a
    - /etc/passwd
    - cat /etc/shadow
  condition: selection_parent and selection_cmd
falsepositives:
- Health-check or diagnostic scripts that call whoami/uname for logging purposes
level: medium
tags:
- attack.t1059
- attack.t1190
id: 0e67dad8-5134-5963-8f76-c9eb95a4f2af
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0770/

Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators and its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply). The paid plans add the security research and news reporting the free tier leaves out.

It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.

Create a free account   What it costs