The advisory clock and the change-window calendar.

The disclosure clock and the change-window calendar do not run at the same speed.

watchTowr reported the chain to Mitel on May 29, 2024. Mitel shipped MiCollab 9.8 SP2 on October 9, 2024, patching CVE-2024-41713 only — the path-normalization bypass that opens the door. The chain partner, CVE-2024-55550 in the ReconcileWizard servlet, was still a 0-day on December 5, 2024, when watchTowr’s 90-day window ran out and they published the working exploit. CISA added both CVEs to KEV on January 7, 2025 with a federal due date of January 28. From the moment the public PoC landed to the moment a FCEB operator was supposed to have patched, eight weeks.

Eight weeks is not a MiCollab change window. A MiCollab upgrade is not a Tuesday-night reboot. The platform sits underneath PBX integrations that have to be regression-tested, SIP trunks that throw fits when the dial plan re-parses, call-recording integrations that depend on specific service-account behavior, voicemail-to-AD plumbing that has to be re-validated against the directory, federated presence, and an approval queue that runs through the people who own the phone bill. The realistic patch cycle for the product is measured in months, not weeks, and a non-trivial fraction of the install base will pace a MiCollab upgrade against the same change calendar that schedules the EHR. The phone system loses to the EHR every time.

This is not a Mitel-specific framing. It is a structural feature of unified communications as a product tier: customer-deployed, deeply integrated, expensive to regress, and as a result the slowest patch cadence in the enterprise outside industrial controls. KEV deadlines are written against a cadence that tier does not deliver on. The 21-day BOD 22-01 clock and the 30-day PCI 6.3.3 clock both assume the operator can apply the fix on the timeline the advisory implies. For a MiCollab front-end the assumption does not hold, and the gap between the assumption and the operating reality is where the in-the-wild exploitation lives.

The narrow remediation is the one Mitel’s advisory describes — apply 9.8 SP2 (9.8.2.12), treat 55550’s “substantially mitigated” status as a floor not a ceiling, and confirm with support before declaring a host done. The interim control that closes the chain without a full upgrade is documented in the long-form blog post: a reverse-proxy rule rejecting any URI containing ..;/, plus removing the /npm-pwg/ and /npm-admin/ paths from the public vhost if NPM is not in active use. The MiCollab admin surfaces should not be reachable from the open internet under any deployment model. Censys counted roughly 8,900 exposed instances on December 17, 2024; watchTowr cited 16,000. The defensible range is wide enough that “MiCollab is not internet-facing” is not a safe assumption about anyone else’s network.

The wider lesson is for the advisory authors. CISA, NVD, and the researcher community write KEV due dates and disclosure deadlines against a generic operator who can apply a fix within weeks. The operator who cannot is not negligent — they are running a product tier where the upgrade calendar is structurally different from the patch clock the advisory runs on. Until the advisory ecosystem models that gap, the in-the-wild record on UC, OT, and other slow-cadence tiers will keep telling the same story.