#watchtowr

Analysis · May 8, 2026 · Colten Anderson

Mitel MiCollab keeps shipping the same path-traversal bug class

watchTowr published a working unauth file-read chain on December 5, 2024 with one of the two CVEs still a 0-day. The pattern across NPM, ReconcileWizard, and AWV is structural, and operators tolerate it because UC is the most upgrade-averse tier in the enterprise.