'Substantially mitigated' is a third state your scanner does not have.

Most vendor advisories ship in a binary: patched or not. Apply the update, the scanner flips green, the audit row clears, the change ticket closes. The whole tooling chain — scanners, SBOMs, KEV trackers, audit spreadsheets — is built on that binary.

Mitel’s MISA-2024-0029 advisory ships in a third state. The CVE-2024-55550 fix in 9.8 SP2 is described as “substantially mitigated,” with a full fix planned for a later release. KB000116041 carries an interim backport for 6.0+ deployments that cannot jump to 9.8. That language is, on the honesty axis, ahead of most advisories. It admits in the document what the document otherwise asks the operator to take on faith. It is also, on the operational axis, an unresolved instruction. The advisory does not say what the partial fix leaves on the table, what input shapes still land in the unsafe path, what logging would detect the residual primitive, or when the follow-up release ships. The operator gets the admission and not the information to act on it.

CISA added CVE-2024-55550 to the KEV catalog on January 7, 2025 alongside its chain partner CVE-2024-41713, with a federal due date of January 28. KEV does not have a “substantially mitigated” column either. The catalog’s affected-products field carries Mitel MiCollab versions through 9.8 SP1 FP2 (9.8.1.201) as vulnerable. A host running 9.8.2.12 reads as out of scope. By the vendor’s own language, that reading is partial. The KEV remediation deadline is a binary checkbox against a CVE the vendor treats as one-and-a-half-binary, and an FCEB operator who patches to 9.8.2.12 and stops has cleared the BOD 22-01 deadline but has not cleared what the vendor said to clear.

The standalone severity discussion compounds the problem. NVD’s 2.7 Low score reads the bug as an authenticated file read because that is what the bug is in isolation. CISA-ADP’s 4.4 Medium rescore reads the same bug with confidentiality high. Both are correct about the bug. Neither models the chain. CVE-2024-41713 is the front door — a ..;/ path-normalization bypass in the NPM front-end that reaches sibling WAR contexts including ReconcileWizard without authentication. CVE-2024-55550 is the second turn, the actual file-read primitive. Chained, the realistic severity is the chain’s, and the chain is critical. The KEV listing names them together for that reason. The scoring infrastructure does not.

The narrow remediation question — what should an operator on 9.8.2.12 do about 55550 — has two answers and the advisory only gives one. The vendor answer is to confirm with Mitel support whether the follow-up release or the KB000116041 backport is available for the deployment, and apply it when it is. The operator answer, the one watchTowr’s writeup makes explicit and the vendor’s advisory does not, is the reverse-proxy rule that closes the chain at the front door: reject any URI containing ..;/, especially /npm-pwg/..;/. The chain dies on that single rule regardless of which side of the partial-fix line 55550 lives on. If NPM is not in active use, the better posture is to take /npm-pwg/ and /npm-admin/ off the public vhost entirely. The MiCollab admin surfaces should not be reachable from the open internet under any deployment model.

The wider lesson is for advisory authors and the tooling that reads them. The honesty of “substantially mitigated” is a step forward. The operational ambiguity it creates is a step the ecosystem has not built the road for. The auditor reading the advisory and the scanner reading the version string end up looking at the same host and reading different states. Until vendor advisories either commit to a binary fix or define what their hedged language means in operator-actionable terms, the gap will keep showing up where the audit lands.