Read the docs
TI-2026-67657 Aliases CVE-2026-104807GHSA-896c-xx42-4m9c

Stored Cross-Site Scripting in Mitel MiVoice Office 400 web portal

Priority LOW 10CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Mitel MiVoice Office 400 versions from 11.0.96.0 contain a stored Cross-Site Scripting flaw in the web portal on TCP port 443. The Description field under Configuration → Domains does not validate or sanitize input before storing and rendering it (CWE-79). An authenticated malicious user can inject persistent JavaScript or HTML that changes the page seen by other users, for example to show attacker-controlled content or support phishing within the application.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domains, specifically in the “Description” field. The application fails to properly validate or sanitize user-supplied input before storing and subsequently rendering the field. By injecting malicious JavaScript into the Description field, an attacker can modify the content and behavior of the affected page when it is viewed by other users. This could allow an attacker to alter the page's appearance, display attacker-controlled content, or construct convincing phishing scenarios within the application's trusted web context.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MitelMitel MiVoice Office 40011.0.96.0—No fix listedCNA
  • Mitel MiVoice Office 400 VendorMitel Affected 11.0.96.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Mitel MiVoice Office 400.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-104807
  2. 2026-10-05 Alias added: GHSA-896c-xx42-4m9c

References

Other 1

  • TI-2022-11960 The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09601 The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-27773 A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab… KEVCVSS 3.1CRITICAL 9.1
  • TI-2024-27770 A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones… KEVCVSS 3.1HIGH 7.2
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2022-19733 The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could… KEVCVSS 3.1MEDIUM 6.8
See all 141 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences