CVE-2021-26714

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-03-29 · updated 2026-06-17

Description

The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insufficient access control. A successful exploit could allow an attacker to view and modify application data via Directory Traversal.

Affected products

Mitel Micontact Center Enterprise: before 9.4 — fixed in 9.4

How to fix

Upgrade to a fixed version: Mitel Micontact Center Enterprise 9.4. Check the vendor advisory for mitigations.

References

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0003
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-21-0003

Get alerted when CVE-2021-26714 or the next vulnerability affects your stack