Mitel has disclosed two significant security vulnerabilities in its enterprise communication platforms – MiVoice MX-ONE and MiCollab – that could allow attackers to bypass authentication protections and execute malicious code.
The company has released critical patches and is urging customers to apply them immediately.
While there are no reports of these flaws being actively exploited, if left unpatched, they could open the door to serious breaches.
“An authentication bypass vulnerability has been identified in the Provisioning Manager component of Mitel MiVoice MX-ONE, which, if successfully exploited could allow an unauthenticated attacker to conduct an authentication bypass attack due to improper access control,” the company said in an advisory.
A successful exploit of this vulnerability could allow an attacker to gain unauthorised access to user or admin accounts in the system.”
Two Major Vulnerabilities
Critical Authentication Bypass in MiVoice MX-ONE (CVSS 9.4): A flaw in the Provisioning Manager component of MiVoice MX-ONE could allow an unauthenticated attacker to completely bypass login protections and gain administrative access.
This vulnerability, which currently has no assigned CVE, has been given a CVSS score of 9.4 marking it as critical.
It stems from improper access control, allowing attackers to effectively walk in the front door without credentials or user interaction.
Affected Versions: MiVoice MX-ONE versions 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14).
Patched In: Version 7.8 (MXO-15711_78SP0) Version 7.8 SP1 (MXO-15711_78SP1).
Until patches can be applied, Mitel strongly advises that organisations do not expose MX-ONE services directly to the public internet and isolate them within a trusted network.
This configuration reduces the immediate risk of remote exploitation but is not a substitute for patching.
High-Severity SQL Injection in MiCollab (CVE-2025-52914, CVSS 8.8): The second vulnerability affects MiCollab, Mitel’s business collaboration and communications platform.
Tracked as CVE-2025-52914, the issue is a high-severity SQL injection flaw that allows an authenticated attacker to execute arbitrary SQL commands.
This could enable access to sensitive provisioning data or manipulation of backend databases – potentially compromising the confidentiality, integrity, and availability of the system.
Affected Versions: MiCollab versions 10.0 (10.0.0.26) through 10.0 SP1 FP1 (10.0.1.101), Version 9.8 SP3 (9.8.3.1) and earlier.
Patched In: Version 10.1 (10.1.0.10), Version 9.8 SP3 FP1 (9.8.3.103).
Why It Matters for IT Leaders
For CISOs, IT directors, and infrastructure teams, the disclosure of these vulnerabilities in Mitel’s MiVoice MX-ONE and MiCollab systems should trigger immediate action.
The systems typically sit at the intersection of VoIP, user provisioning, and internal collaboration.
A successful compromise here doesn’t simply disrupt a single service: it has the potential to grant attackers administrative control over interconnected platforms, enable eavesdropping on sensitive communications, and facilitate lateral movement across the network.
In essence, the breach of one trusted communications node could cascade into a broader security event.
Timing is equally critical. Although there’s no confirmed evidence of exploitation as of now, the nature of public vulnerability disclosure means the window to act is limited.
Threat actors – including ransomware groups – routinely monitor vendor advisories, waiting for exactly these moments.
It’s common to see automated scanning and weaponization begin within days to weeks of a major vulnerability being announced.
A delay in patching, even by a few days, could transform a containable issue into a full-blown security incident.
The risk is especially acute in cloud and hybrid environments, where components like the Provisioning Manager might be exposed to the public internet for ease of remote administration or third-party integrations.
MX-ONE’s flexibility to support on-premises, private, and public cloud deployments is a double-edged sword: it enables scalability, but also increases the risk profile if configuration and segmentation are not carefully managed.
Bottom Line
Perhaps most concerning is the nature of the MX-ONE flaw itself: an authentication bypass.
These types of vulnerabilities are rare but extremely dangerous because they undermine one of the most fundamental assumptions in enterprise security – that access requires authentication.
While Mitel has acted quickly to release patches, the real risk lies in delayed response from the organisations that rely on these tools every day.
For IT and security leaders, this is more than a routine update – it’s a chance to harden core infrastructure, reaffirm access controls, and prevent a preventable breach.
