---
id: "CVE-2024-55550"
kind: "vulnerability"
aliases: ["CVE-2024-55550"]
title: "Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a\u2026"
severity: "medium"
cvss: 4.4
epss: null
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Mitel MiCollab", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "mitel micollab", "fixed": [], "affected": "<= 9.8.1.201", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "mitel-micollab", "ransomware", "self-hosted", "unified-communications", "vendor"]
not_affected_if: ["not-running-micollab"]
published_at: "2024-12-10T19:15:31+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55550", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55550", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a…

Mitel MiCollab has a path traversal flaw in which an authenticated administrator can read arbitrary local files on the server. The source says it can be chained with CVE-2024-41713, an unauthenticated remote file-read bug, and CISA lists it as actively exploited with ransomware use.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Mitel MiCollab affected ? fixed ?
- vendor:mitel micollab affected <= 9.8.1.201 fixed ?

## Fix

Apply the vendor mitigations per CISA guidance; if none are available, discontinue use of the product. Specific patched versions: unknown

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-55550
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-55550

## From the sources

Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_