CVE-2026-104808

Name of the Vulnerable Software and Affected Versions Mitel MiVoice Office 400 (affected versions not specified)

Description A stored Cross-Site Scripting (XSS) flaw allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web portal listening on TCP port 443. The issue occurs within the Configuration → Users → Users List section, specifically in the Microsoft Exchange mailbox field, due to a failure to properly validate or sanitize user-supplied input. When the affected user properties are accessed, the injected payload executes, which can prevent access to those properties and lead to a denial-of-service condition within the application's user-management functionality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the Microsoft Exchange mailbox field in the user list until the issue is resolved.