CVE-2026-104706 Mitel CVE debrief

Who should care

Defenders and administrators of systems with administrative access should assess potential exposure and impact. They should prioritize verifying exposure and assessing potential impact, focusing on systems with administrative access, due to the high severity of the vulnerability and potential for sensitive file access. They should also review compensating controls for exposed systems while remediation is scheduled.

Why it matters

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems with administrative access, due to the high severity of the vulnerability and potential for sensitive file access.

• Verify exposure and assess potential impact on sensitive system files and data
• Implement compensating controls to limit access to administrative interfaces
• Monitor for potential exploitation attempts

Technical summary

The vulnerability allows users to view or download sensitive system files via the portal https://<ip>:8443 through menus Administration -> View Logs. The CVSS score is 8.4, indicating a high severity. This vulnerability could potentially allow attackers to access sensitive information, and defenders should assess the potential exposure and impact on their systems. The vulnerability is a path traversal vulnerability, and defenders should prioritize verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, focusing on systems with administrative access.

Recommended defensive actions

• Verify exposure by checking system configurations and access controls
• Assess potential impact on sensitive system files and data
• Implement compensating controls to limit access to administrative interfaces

Evidence notes

The vulnerability was discovered by DigitalCanion and reported through the CVE Program. The NVD entry is currently being processed. The source details are limited, and defenders should verify the exposure and assess potential impact based on the available information. The CVE record was published on 2026-10-05T09:17:09.167Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.