Mitel patches MX-ONE flaw giving LAN attackers PBX admin rights

Mitel patches MX-ONE flaw giving LAN attackers PBX admin rights

11 November 2026: Mitel has fixed a critical authentication bypass in the Service Node Manager of MiVoice MX-ONE, its large-enterprise PBX, that lets an attacker on the internal network with no credentials take administrative control and change call routing and service configuration. Advisory MISA-2026-0011, issued on 11 November, scores it 9.4 under CVSS 3.1 and covers MX-ONE 8.0 (8.0.0.33) to 8.2 SP1 (8.2.1.0.14), together with two lesser flaws; hotfixes are available for the 8.2 releases.

Not yet independently verified. Mitel has requested CVE numbers but none is assigned yet, and its advisory does not say whether the flaws have been exploited; the scores are Mitel's own. We will update this when it can be confirmed, and remove this note.

Three flaws in the management tools

Mitel identifies the flaws by its own numbers, because the CVE identifiers it has requested have not been assigned.

• MTLVULN-1860, Service Node Manager, Critical 9.4: improper authentication lets an unauthenticated attacker with LAN access gain administrative access, then view and modify PBX routing and service configuration.
• MTLVULN-1859, Service Node Manager, High 8.2: insufficient sanitising of parameters allows command injection, running arbitrary operating system commands with the management service account's privileges. It needs administrative rights and LAN access.
• MTLVULN-1858, Provisioning Manager, Medium 6.5: weak authorisation lets any authenticated user with LAN access read system configuration data.

Mitel warns that chaining them can significantly amplify the impact. The obvious chain is the bypass followed by the injection: the first hands out the administrative rights the second needs, which takes an attacker from the office network to commands on the management server.

Hotfixes now, 8.3 later

The fixes are hotfixes MX-ONE PM/SNM 8.2 SP0 HF5 and 8.2 SP1 HF2, or later. Mitel points to knowledge base articles KB000127971 and KB000128772 for the hotfix release notes and KB000129185 for the security update itself. MX-ONE 8.3 will carry the fixes when it is released; Mitel gives no date for it. Releases already past end of support are not covered, so a site on an older line has no fix in this advisory and needs to move to a supported 8.2 release first.

Limiting exposure until the hotfix is in

All three flaws need a route to the management interfaces from the network, which is why Mitel describes the attacker as having LAN access. Restricting Service Node Manager and Provisioning Manager to a management network or a short list of administrator addresses narrows who can reach the bypass while the hotfix is scheduled. A voice platform is often patched less often than servers, and a change to routing can divert calls or open toll fraud, so the PBX's routing and service configuration should be compared against a known-good export after patching. Mitel lists no workaround.

INCIBE-CERT in Spain republished the advisory on 12 November.

Our catalogue lists nine business phone systems and 15 VoIP products.

Sources

• Mitel: Product Security Advisory MISA-2026-0011, 11 November 2026
• INCIBE-CERT: Multiple vulnerabilities in Mitel MiVoice MX-ONE, 12 November 2026