Loading story…
Attackers have exploited CVE-2022-29499, a critical unauthenticated remote code execution flaw in the Service Appliance component of Mitel MiVoice Connect, to gain initial access to targeted environments. The vulnerability was caused by insufficient input validation in a diagnostic script, allowing crafted requests to inject commands on exposed appliances. Mitel disclosed the issue in April and released patches in early June, after which security researchers reported active intrusion activity tied to the flaw.
Reports from Rapid7 and CrowdStrike said the vulnerability was used in real-world compromises, including a limited number of successful intrusions, though there was no indication of broad internet-scale exploitation or widespread ransomware abuse at the time. Defenders were urged to patch immediately, keep MiVoice Connect Service Appliances off the public internet where possible, and strengthen network filtering and least-privilege controls to reduce the risk of command execution and follow-on compromise.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
CrowdStrike published an analysis describing a ransomware intrusion attempt that used CVE-2022-29499 as the initial access vector. The write-up publicly documented exploitation of the Mitel vulnerability.
Mitel released fixes for CVE-2022-29499 in early June 2022. The patches addressed the critical command injection issue affecting MiVoice Connect Service Appliance deployments.
Mitel published a security advisory for CVE-2022-29499, a critical remote code execution flaw in the Service Appliance component of MiVoice Connect. At the time of disclosure, the vulnerability was unpatched.
Rapid7 made a remote version-based vulnerability check available for InsightVM and Nexpose customers to assess exposure to CVE-2022-29499. The check was released the day after Rapid7's blog post.
CrowdStrike detected a ransomware intrusion attempt that used CVE-2022-29499 as an initial access vector while the flaw was still an undisclosed zero-day. Rapid7 also observed a small number of intrusions leveraging the same vulnerability for initial access.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **CVE-2026-20230**, a critical flaw in Cisco Unified Communications Manager (**Unified CM**) and Unified CM Session Management Edition (**Unified CM SME**), shortly after technical details and proof-of-concept code became public. Cisco said the bug stems from improper input validation in certain HTTP requests and can let an unauthenticated attacker perform **SSRF**, write arbitrary files to the underlying operating system, and potentially escalate privileges to **root**; researchers also described a path to unauthenticated remote code execution. Exploitation requires the **WebDialer** service to be enabled, although Cisco notes it is disabled by default. Exploit intelligence firm Defused reported seeing attacks from a single source using an unvetted PoC, with `file://` file-write payloads observed against decoy systems over the weekend. Cisco patched the issue in **Unified CM 14SU6** and **15SU5**, while SSD Secure Disclosure, which reported the vulnerability, published additional technical details showing how attackers could recover a target's true hostname and progress toward code execution. Cisco has advised customers to apply the fixes and, if patching cannot be done immediately, disable **WebDialer** to reduce exposure on widely deployed enterprise voice platforms.
Aug 15, 2026
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jul 23, 2026
Ivanti remediated **CVE-2025-0282**, a CVSS 9.0 unauthenticated remote-code-execution flaw affecting Ivanti Connect Secure and Policy Secure appliances. Ivanti warned that the vulnerability was being actively exploited, and public proof-of-concept code was released, increasing the risk of opportunistic compromise. The company also fixed **CVE-2025-0283**, a CVSS 7.0 local privilege-escalation vulnerability. Organizations should apply Ivanti’s updates immediately and use the Ivanti Integrity Checker Tool to identify indicators of compromise. Where compromise is detected, Ivanti advises resetting affected appliances to factory defaults and following its recovery process; defenders should also monitor surrounding networks and credentials for malicious activity or persistence.
Aug 31, 2026