Mitel confirms Brotli decoder out-of-bounds write (CVE-2026-111497) affects MiVoice Business and OpenScape products; patches still pending
CERT-FR published advisory CERTFR-2026-AVI-1477 on 6 November 2026 relaying Mitel security bulletin MISA-2026-0010 (28 October 2026), which reports a vulnerability allowing remote arbitrary code execution in several Mitel products. The underlying flaw, CVE-2026-111497, is an out-of-bounds write in the Google Brotli decoder library, publicly disclosed in October 2026 and tracked by Mitel under the name node2shell (mitel.com). According to Mitel, successful exploitation could let an unauthenticated attacker cause a denial of service and potentially disclose sensitive information or execute arbitrary code through improper handling of malformed compressed data; the vendor rates the severity as high on CVSS 3.1 and states the rating is based on publicly available information (mitel.com). Mitel is still investigating a large part of its portfolio, and the affected products listed so far have planned updates rather than released fixes, with workarounds published in knowledge base articles for OpenScape SBC, OpenScape SESAP and OpenScape Contact Center (mitel.com). No exploitation in the wild is reported by CERT-FR or by Mitel, and the vendor notes that cloud services Unify Phone and CloudLink have already been updated (mitel.com).
Entenda a falha
A vulnerabilidade
CVE-2026-111497 is an out-of-bounds write in the Google Brotli decoder library, bundled in several Mitel products (tracked by Mitel as node2shell). Per Mitel bulletin MISA-2026-0010, an unauthenticated remote attacker can cause denial of service and potentially disclose information or execute arbitrary code by sending malformed Brotli-compressed data. Mitel rates it high on CVSS 3.1. Affected: MiVoice Business 10.6.0.7 and earlier, MiVoice Business Solution Virtual Instance 2.1.0.9 and earlier, OpenScape SBC V11R3.4.4 and earlier, OpenScape Xpert V9 R0.2.0 and earlier, OpenScape SESAP V2 R1.1.9 and earlier, OpenScape Contact Center V12R0 to V12R0FR7, OpenScape Endpoint Management V1 R2.5.1 and earlier. No fixed release exists yet; many other products are still under investigation.
Como funciona
A product receives data compressed with Brotli and passes it to the bundled Brotli decoder to decompress it. If the data is malformed, the decoder mishandles it while decompressing and writes outside the memory it should use. That corrupts memory, which can crash the service, expose data or, potentially, let the attacker run code. Exposure therefore depends on whether the product parses attacker-supplied Brotli data.
Por que é vulnerável
The root cause is in the third-party Brotli decoder library, not in Mitel code: improper handling of malformed compressed data leads to an out-of-bounds write. Mitel inherits the flaw by bundling the component. The articles do not describe the exact coding error or why it went unnoticed. Mitel says products where the component is absent or the function unused are Not Affected, though scanners may still flag the library.
Como foi descoberta
The articles do not say who found the flaw. According to the story, the Brotli vulnerability was publicly disclosed in October 2026; Mitel published bulletin MISA-2026-0010 on 28 October 2026 (revision 5.0 updated 4 November), and CERT-FR relayed it as CERTFR-2026-AVI-1477 on 6 November 2026. Neither Mitel nor CERT-FR reports exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 08/11/2026 11:20.
Detalhes técnicos
The root cause is in a third-party component, the Brotli decompression library, not in Mitel code; exposure therefore depends on whether a product parses attacker-supplied Brotli-compressed data. Mitel states that "Not Affected" verdicts cover products where the component is absent or the function is unused, and warns that vulnerability scanners may still flag the vulnerable component in those products (mitel.com). As of revision 5.0 of the advisory (last updated 4 November 2026), the affected products are MiVoice Business 10.6.0.7 and earlier, MiVoice Business Solution Virtual Instance 2.1.0.9 and earlier, OpenScape SBC V11R3.4.4 and earlier, OpenScape Xpert V9 R0.2.0 and earlier, OpenScape SESAP V2 R1.1.9 and earlier, OpenScape Contact Center V12R0 to V12R0FR7 and OpenScape Endpoint Management V1 R2.5.1 and earlier; many other products including MiCollab Advanced Messaging, Mitel Business Analytics, Mitel Performance Analytics, Mitel Revolution, OpenScape UC Application and MiTeam Meetings remain under investigation (mitel.com). Mitel notes MXeIII, CXII and AX hardware are not affected (mitel.com).
Remediação
No fixed release is available yet for the affected on-premises products. Mitel announces planned updates: OpenScape SBC V11R3.4.5, OpenScape SESAP V2 R1.1.10 and OpenScape Contact Center V12R0FR8, with no target release named for MiVoice Business, MiVoice Business Solution Virtual Instance, OpenScape Xpert or OpenScape Endpoint Management (mitel.com). In the interim, apply the vendor workarounds described in knowledge base articles KB000129034 (MiVoice Business, MiVoice Business Solution Virtual Instance, OpenScape SESAP), KB000129100 (OpenScape SBC) and KB000129114 (OpenScape Contact Center), restrict network exposure of the management and signalling interfaces of these systems, and monitor MISA-2026-0010 for revisions as more products move out of "Investigating" status (mitel.com, cert.cyber.gouv.fr).
Linha do tempo
-
Mitel confirms Brotli decoder out-of-bounds write (CVE-2026-111497) affects MiVoice Business and OpenScape products; patches still pending
ler a análise desta fonte ocultar
CERT-FR published advisory CERTFR-2026-AVI-1477 on 6 November 2026 relaying Mitel security bulletin MISA-2026-0010 (28 October 2026), which reports a vulnerability allowing remote arbitrary code execution in several Mitel products. The underlying flaw, CVE-2026-111497, is an out-of-bounds write in the Google Brotli decoder library, publicly disclosed in October 2026 and tracked by Mitel under the name node2shell (mitel.com). According to Mitel, successful exploitation could let an unauthenticated attacker cause a denial of service and potentially disclose sensitive information or execute arbitrary code through improper handling of malformed compressed data; the vendor rates the severity as high on CVSS 3.1 and states the rating is based on publicly available information (mitel.com). Mitel is still investigating a large part of its portfolio, and the affected products listed so far have planned updates rather than released fixes, with workarounds published in knowledge base articles for OpenScape SBC, OpenScape SESAP and OpenScape Contact Center (mitel.com). No exploitation in the wild is reported by CERT-FR or by Mitel, and the vendor notes that cloud services Unify Phone and CloudLink have already been updated (mitel.com).
Technical Details
The root cause is in a third-party component, the Brotli decompression library, not in Mitel code; exposure therefore depends on whether a product parses attacker-supplied Brotli-compressed data. Mitel states that "Not Affected" verdicts cover products where the component is absent or the function is unused, and warns that vulnerability scanners may still flag the vulnerable component in those products (mitel.com). As of revision 5.0 of the advisory (last updated 4 November 2026), the affected products are MiVoice Business 10.6.0.7 and earlier, MiVoice Business Solution Virtual Instance 2.1.0.9 and earlier, OpenScape SBC V11R3.4.4 and earlier, OpenScape Xpert V9 R0.2.0 and earlier, OpenScape SESAP V2 R1.1.9 and earlier, OpenScape Contact Center V12R0 to V12R0FR7 and OpenScape Endpoint Management V1 R2.5.1 and earlier; many other products including MiCollab Advanced Messaging, Mitel Business Analytics, Mitel Performance Analytics, Mitel Revolution, OpenScape UC Application and MiTeam Meetings remain under investigation (mitel.com). Mitel notes MXeIII, CXII and AX hardware are not affected (mitel.com).
Remediation
No fixed release is available yet for the affected on-premises products. Mitel announces planned updates: OpenScape SBC V11R3.4.5, OpenScape SESAP V2 R1.1.10 and OpenScape Contact Center V12R0FR8, with no target release named for MiVoice Business, MiVoice Business Solution Virtual Instance, OpenScape Xpert or OpenScape Endpoint Management (mitel.com). In the interim, apply the vendor workarounds described in knowledge base articles KB000129034 (MiVoice Business, MiVoice Business Solution Virtual Instance, OpenScape SESAP), KB000129100 (OpenScape SBC) and KB000129114 (OpenScape Contact Center), restrict network exposure of the management and signalling interfaces of these systems, and monitor MISA-2026-0010 for revisions as more products move out of "Investigating" status (mitel.com, cert.cyber.gouv.fr).