Mitel MiVoice Office 400 11.0.96.0 Microsoft Exchange Mailbox Field cross site scripting

Summaryinfo

A vulnerability identified as problematic has been detected in Mitel MiVoice Office 400 11.0.96.0. Affected is an unknown function of the component Microsoft Exchange Mailbox Field. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-104808. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Mitel MiVoice Office 400 11.0.96.0 and classified as problematic. This issue affects some unknown functionality of the component Microsoft Exchange Mailbox Field. The manipulation with an unknown input leads to a cross site scripting vulnerability. Using CWE to declare the problem leads to CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Impacted is integrity. The summary by CVE is:

DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application. The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Users → Users List. The vulnerability occurs in the “Microsoft Exchange mailbox” field, which fails to properly validate or sanitize user-supplied input before storing and rendering it. By injecting malicious JavaScript into this field, an attacker can cause the payload to execute whenever the affected user properties are accessed. This can prevent access to the affected user properties and result in a denial-of-service condition within the application's user-management functionality.

It is possible to read the advisory at digitalcanion.com. The identification of this vulnerability is CVE-2026-104808 since 10/02/2026. The exploitation is known to be easy. The attack may be initiated remotely. It demands that the victim is doing some kind of user interaction. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Mitel

Name

• MiVoice Office 400

Version

• 11.0.96.0

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion