Mitel has released hotfixes for three vulnerabilities in its MiVoice MX-ONE telephony platform, including an authentication bypass rated CVSS 9.4 that lets an unauthenticated attacker on the local network log in as an administrator. The fixes are described in advisory MISA-2026-0011.
Authentication Bypass in Service Node Manager
The most serious flaw sits in the Service Node Manager. An attacker with access to the internal network can bypass authentication, sign in with administrator rights and modify the PBX’s routing and configuration. The flaw scores 9.4 on the CVSS scale.
Control of routing and configuration is the practical prize. An administrator can reroute calls or change how the system handles them, and disrupt telephone service for an organization that relies on it.
Command Execution and Configuration Read Flaws
Two further bugs raise the impact when combined with the first. A parameter sanitization failure lets an administrator run operating system commands as the management service account. Separately, weak authorization in the Provisioning Manager lets any logged-in user read system configuration.
Chained, the three give an attacker a route from no credentials on the LAN to administrator access, command execution and a view of the system’s configuration.
Limits of the Mitel MISA-2026-0011 Advisory
All three flaws require access to the internal network. Mitel has not reported any attacks or public exploit code. CVE identifiers have been requested but not yet assigned. The advisory does not assess versions that have reached end of support. The report on the flaws comes from a single source, so the details reflect what Mitel’s advisory states.
Mitel’s Track Record in the KEV Catalog
Seven Mitel flaws are already listed in the CISA Known Exploited Vulnerabilities catalog. That history means attackers have previously taken an interest in the vendor’s products, even though this advisory carries no exploitation report.
Mitel MX-ONE Hotfixes and Hardening Steps
Mitel’s fixes are Hotfix 8.2 SP0 HF5 or 8.2 SP1 HF2, or later builds. The 8.3 release will include the fixes. Mitel also recommends restricting management interfaces to trusted hosts.
That last measure follows directly from the attack requirements. Because every flaw needs internal network access, keeping the management interfaces reachable only from trusted systems limits who can attempt the authentication bypass in the first place.
Why Internal-Only Flaws Still Matter
Flaws that need local network access are often treated as lower priority than internet-facing bugs. In practice, an attacker who has already landed on any machine inside a network, through phishing or another compromise, can use a LAN-only bypass to move onto infrastructure such as a PBX. An authentication bypass that needs no credentials removes the step where an attacker would otherwise have to steal an administrator password.
For organizations that depend on MX-ONE for voice service, the decision is mostly about sequence. Applying the hotfix closes the authentication bypass, while network restrictions on the management interfaces reduce exposure from the other two flaws that require a logged-in account. Administrators will also need to watch for the CVE assignments Mitel has requested, so that vulnerability scanners can track these issues by identifier.
Telephony Systems as Network Infrastructure
A PBX such as MX-ONE carries all of an organization’s voice traffic, and the Service Node Manager controls routing. The authentication bypass at CVSS 9.4 therefore gives an attacker a place to intercept, redirect or disrupt calls, which is the impact Mitel’s advisory describes as telephony takeover, call rerouting and service disruption.
Patch Sequencing for MX-ONE Operators
Mitel’s hotfix naming, 8.2 SP0 HF5 and 8.2 SP1 HF2, means operators on different service packs need different builds, and the company says 8.3 will carry the fixes when it ships. Operators on end-of-support versions have no guidance, since the advisory states that those versions were not assessed.
