---
id: "CVE-2022-26143"
kind: "vulnerability"
aliases: ["CVE-2022-26143"]
title: "Mitel MiCollab, MiVoice Business Express: MiCollab, MiVoice Business Express Access Control Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.87325
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Mitel MiCollab, MiVoice Business Express", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "micollab", "mitel", "mivoice-business-express", "self-hosted", "voip"]
not_affected_if: ["unknown"]
published_at: "2022-03-10T17:47:32+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26143", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2022-26143", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26143", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Mitel MiCollab, MiVoice Business Express: MiCollab, MiVoice Business Express Access Control Vulnerability

Mitel MiCollab and MiVoice Business Express have an access control flaw that lets an attacker reach sensitive information and services without authorization, and can also degrade performance or cause denial of service. CISA lists it in the Known Exploited Vulnerabilities catalog, so attacks are happening in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Mitel MiCollab, MiVoice Business Express affected ? fixed ?

## Fix

Apply the updates per the vendor instructions (CISA required action); the specific fixed version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-26143
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2022-26143
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2022-26143

## From the sources

The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_