CVE-2023-40265 is a high severity (CVSS 8.8) flaw in Atos Unify OpenScape Xpressions WebAssistant V7. The record says it allows authenticated remote code execution via file upload. Releases before V7R1 FR5 HF42 P911 are affected.
What's affected
The record names Atos Unify OpenScape Xpressions WebAssistant V7, with every build before V7R1 FR5 HF42 P911 affected. It scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The product string in the record also carries the Mitel name.
The weakness is CWE-434 (unrestricted upload of a file of a dangerous type). The same advisory, OBSO-2305-03, is the reference for CVE-2023-40266, a path traversal in the same component, so both share the same fixed build in the record.
Unify's advisory PDF named in the record returned a not found error when we tried to fetch it, so what follows rests on the NVD record. Confirm details with the vendor advisory before you rely on this page for a change decision.
How to check if you're exposed
WebAssistant is the web interface of the Xpressions server. Find the installed release and hotfix level from the administration pages or from the team that manages your messaging platform, and compare it with V7R1 FR5 HF42 P911. Anything earlier is in scope.
Also check whether the WebAssistant interface is reachable from the internet or from user networks that do not need it. A flaw that needs a login is much less of a problem when only a few administrators can reach the page.
What to do now
- Inventory your OpenScape Xpressions servers and record the release and hotfix level.
- Apply V7R1 FR5 HF42 P911 or later, and read advisory OBSO-2305-03 for the vendor's steps.
- Restrict access to the WebAssistant web interface to the networks and users that need it.
- Review accounts and remove unused ones, since the attack needs a login.
- After patching, look in upload directories on the server for files that should not be there.
Why it matters
File upload flaws let a user place a file on the server and then get the server to run it. The usual causes are missing checks on file type or location, or letting an upload land where the web server executes content. The record says only that code execution is possible through file upload, so we describe the class, not a method.
Fixing it in the vendor build is the right answer, because filters bolted on at a proxy are easy to get wrong. If you cannot patch at once, narrowing who can reach the page is the next best control, and it also helps with the path traversal issue in the same component.
Quick check
Is this the same bug as CVE-2023-40266?
No. Both are in OpenScape Xpressions WebAssistant and share a vendor advisory, but 40265 is an authenticated file upload leading to code execution and 40266 is a path traversal. The fixed build named in the record is the same.
Does the record say it is exploited in the wild?
No. The KEV flag in the record is false and we found no source saying it is exploited.
Sources
Last reviewed: 19 October 2026.
