# CVE-2026-104807: Mitel MiVoice Office 400 stored XSS in Domains description

Source: https://junglewise.ai/threats/cve-2026-104807-digitalcanion-has-discovered-a-stored-cross-site-scripting-xss  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-05. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2026-104807 · Severity: info · Published 2026-10-05

Mitel MiVoice Office 400 is a unified communications appliance used by enterprises for phone and messaging services. An authenticated attacker can inject malicious JavaScript into the Domains description field, which persists and executes when other users view that page, enabling account takeover, credential theft, or malware distribution within the trusted application context.

Technologies: [Mitel MiVoice Office 400](https://junglewise.ai/threats/technologies/mivoice-office-400). Vendors: [Mitel](https://junglewise.ai/threats/vendors/mitel).

## Quick answers

**Is CVE-2026-104807 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-104807 being exploited in the wild.

**How severe is CVE-2026-104807?** Informational severity, published 5 October 2026.

**Which products and versions are affected?** Mitel MiVoice Office 400 version 11.0.96.0 and earlier.

**Is there a fix for CVE-2026-104807?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-104807 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-104807?** Check whether you run Mitel MiVoice Office 400 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in the web portal's Configuration → Domains section, specifically in the Description field, due to insufficient input validation and output encoding. An authenticated user can inject persistent JavaScript or HTML that executes in the browsers of other users viewing the affected page, allowing session hijacking, credential capture, or phishing attacks within the application's trusted security context.

## Affected products

- Mitel MiVoice Office 400 version 11.0.96.0 and earlier

## Timeline

- 2026-10-05: disclosed

## References

- [https://digitalcanion.com/en/security-research/](https://digitalcanion.com/en/security-research/)

## Related threats

- [Mitel MiVoice Office 400 code execution via WAV file upload](https://junglewise.ai/threats/cve-2026-104811-digitalcanion-sa-has-discovered-a-vulnerability-that-allows)
- [Mitel MiVoice Office 400 path traversal in file browser](https://junglewise.ai/threats/cve-2026-104810-this-vulnerability-allows-remote-attackers-to-delete-sensitive)
- [Mitel MiVoice Office 400 shared object hijacking arbitrary code execution](https://junglewise.ai/threats/cve-2026-104809-digitalcanion-has-discovered-a-vulnerability-that-allows-an)
- [Mitel MiVoice Office 400 stored XSS in Exchange mailbox field](https://junglewise.ai/threats/cve-2026-104808-digitalcanion-has-discovered-a-stored-cross-site-scripting-xss)
- [Mitel MiVoice Office 400 path traversal in System Logs](https://junglewise.ai/threats/cve-2026-104806-digitalcanion-has-discovered-a-path-traversal-vulnerability-that)