Mitel fixes critical authentication bypass in MiVoice MX-ONE

Mitel fixed three MiVoice MX-ONE vulnerabilities in its enterprise PBX platform, including a critical authentication bypass rated CVSS 9.4. Disclosure from Daily CyberSecurity attributes the flaws to the Provisioning Manager and Service Node Manager components. An attacker on the internal LAN could bypass authentication, log in as an admin and then run operating system commands.

Mitel notes that chaining the flaws “can significantly amplify their impact, potentially resulting in a critical severity.” The report also outlines a separate command-injection flaw and an unauthorized-access weakness within the same management interfaces. While Mitel reports no public exploitation at this time, the CVE IDs remain pending and a CVE identifier has been requested but is not yet assigned.

The flaws are described as follows: MTLVULN-1860 (authentication bypass, CVSS 9.4) enables an unauthenticated LAN user to access admin functions and modify PBX routing and service configuration; MTLVULN-1859 (command injection, CVSS 8.2) could let an attacker with admin access execute OS commands with the management service account’s privileges; MTLVULN-1858 (unauthorized access, CVSS 6.5) allows a logged-in user with any privilege level to read system configuration data.

The affected versions are MiVoice MX-ONE 8.0 (8.0.0.33) through 8.2 SP1 (8.2.1.0.14). Mitel lists fixes in MX-ONE 8.2 SP0 HF5 and 8.2 SP1 HF2, with 8.3 expected to include the corrections. Mitel’s advisory MISA-2026-0011 and the MX-ONE security update knowledge base describe the patching path, and Daily CyberSecurity advises restricting access to the Provisioning Manager and Service Node Manager interfaces to trusted admin hosts until patches are applied.