CVE-2026-104807 Mitel CVE debrief

Who should care

Defenders responsible for the affected system or component should assess exposure and prioritize verification and mitigation efforts. Defenders should care about CVE-2026-104807 because it represents a stored Cross-Site Scripting (XSS) vulnerability that could allow an authenticated attacker to inject persistent JavaScript or HTML content into the web application, potentially affecting the appearance or behavior of the affected page when viewed by other

Why it matters

Defenders should care about CVE-2026-104807 because it represents a stored Cross-Site Scripting (XSS) vulnerability that could allow an authenticated attacker to inject persistent JavaScript or HTML content into the web application, potentially affecting the appearance or behavior of the affected page when viewed by other users. The vulnerability exists in the 'Description' field under Configuration → Domains, and its exploitation requires authentication and user interaction. Defenders responsible for the affected system or component should assess exposure and prioritize verification and mitigation efforts.

• Potential modification of page content or behavior
• Possible construction of phishing scenarios within the application's trusted web context
• Risk of displaying attacker-controlled content

Technical summary

The vulnerability exists in the web portal listening on TCP port 443, under Configuration → Domains, specifically in the 'Description' field. The application fails to properly validate or sanitize user-supplied input before storing and subsequently rendering the field. This allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application, potentially affecting the appearance or behavior of the affected page when viewed by other users. An attacker can modify the content and behavior of the affected page when viewed by other users, potentially altering the page's appearance or constructing phishing scenarios.

Defensive priority

Defenders should prioritize verifying the vulnerability's existence and scope within their environment, and apply patches or mitigations if available.

Recommended defensive actions

• Verify the vulnerability's existence and scope within your environment
• Apply patches or mitigations if available
• Monitor for suspicious activity related to the affected component
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information from the vendor and other sources may be necessary to fully understand the issue. The vulnerability exists in the web portal listening on TCP port 443, under Configuration → Domains, specifically in the 'Description' field. The application fails to properly validate or sanitize user-supplied input before storing and subsequently rendering the field. Defenders should verify the vulnerability's existence and scope within their environment and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.