Is CVE-2022-40765 (Mitel MiVoice Connect Command Injection) being exploited in the wild?

Yes. CISA added CVE-2022-40765 to its Known Exploited Vulnerabilities catalogue on 21 February 2023, which it does only when there is reliable evidence of active exploitation. CISA lists it as known to be used in ransomware campaigns. The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.

What “exploited in the wild” means for CVE-2022-40765

For this CVE, the practical answer is not just that the flaw exists, but that it has crossed the line from theoretical risk to confirmed abuse. When CISA places a vulnerability in KEV, it is signalling that defenders should treat it as actively weaponised and time-sensitive, especially where the affected product sits on a network edge or can be reached internally by an attacker.

That matters here because the issue is a command-injection path in a product component that can turn authenticated access into system-level command execution. In real environments, that combination often changes the problem from “patch soon” to “assume exposure until proven otherwise.”

How to confirm whether you are exposed

The first step is to confirm whether any Mitel MiVoice Connect installations use the Edge Gateway component implicated by this CVE, and whether that component is reachable from the internal network segments it should not trust by default. Exposure checks should include asset inventory, version identification, and any remote administration or integration paths that could let an internal foothold reach the vulnerable service.

For authoritative product and remediation details, use the vendor advisory and the CISA Known Exploited Vulnerabilities Catalog rather than relying on summaries. If your team needs a broader triage path, the Zero-Day and Exploited Vulnerabilities Guide is useful for organising urgent response around KEV-listed issues and post-patch verification.

Containment, patching, and compromise checks

Because the flaw is already treated as actively exploited, the remediation sequence should be: verify exposure, apply the vendor fix or mitigation, then look for signs of prior abuse. If patching cannot happen immediately, isolate the affected component, restrict internal reachability, and treat every authentication path into that system as high risk until the window closes.

Command injection can leave little obvious evidence if the attacker used it briefly for staging, reconnaissance, or credential theft. Review logs for unexpected command execution, unusual child processes, new accounts or altered settings, and any signs that the system was used as a pivot point. The KEV catalogue should be paired with your internal incident hunt so that patching is not mistaken for proof of safety.

Risk and Threat Considerations

This CVE is especially concerning because the attack path combines an authenticated entry condition with command execution on a system that may already sit close to voice infrastructure and internal trust boundaries. That makes it attractive for attackers who first gain a foothold elsewhere, then use the vulnerable component to expand access or stage follow-on activity.

Failure mechanism: An attacker with internal network access and valid authentication reaches the vulnerable Edge Gateway code path and injects commands that the system executes in its own context, turning ordinary access into broader control.

Impact: The result can include service disruption, configuration tampering, data exposure, persistence, or use of the system as a launch point for lateral movement and ransomware staging.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST SP 800-53 Rev 5, NIST CSF 2.0 and OWASP ASVS set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	Active exploitation makes urgent vulnerability handling central to this CVE.
Recommendation — Prioritise and remediate KEV-listed vulnerabilities on an emergency timeline.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	This CVE requires rapid flaw tracking, mitigation, and verification after remediation.
	SI-4 — System Monitoring	Post-exploit checks depend on detecting suspicious commands and related activity.
Recommendation — Track, remediate, and verify exploited flaws without delaying for normal release cycles. Monitor for indicators of exploitation and investigate abnormal system behaviour promptly.
NIST CSF 2.0	ID.RA-01 — Asset Vulnerability Identification	Confirming exposure to a KEV-listed CVE starts with identifying vulnerable assets.
Recommendation — Identify assets exposed to known exploited vulnerabilities and prioritise them for response.
OWASP ASVS	V15 — Secure Coding and Architecture	Command injection is an application design and input-handling failure.
Recommendation — Eliminate command execution paths driven by unsanitised input and unsafe system calls.

Practitioner Guidance

What to prioritise: Treat any KEV-listed exposure as an urgent operational issue, not a normal patch queue item. If the component is internet-facing or reachable from broad internal networks, narrow that path first, then validate the fix and only then relax containment.

What to verify: Confirm that the vulnerable component is not just patched, but also that no suspicious commands, new admin activity, or unexpected service changes occurred before remediation. A clean patch state does not rule out prior compromise.

Practitioner takeaway: For actively exploited command-injection flaws, the decision point is not whether exploitation is possible, but whether you have already reduced the blast radius enough to trust the system while remediation completes.