CVE-2026-18085

Published: Jul 28, 2026Modified: Aug 14, 2026

5.9

Vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: secure@blackberry.com (Secondary)

Description

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service.

Affected (17)

Products: Blackberry: Unified Endpoint Manager

Blackberry

1 product

Unified Endpoint Manager

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
Blackberry Unified Endpoint Manager	Version 12.23.0
Blackberry Unified Endpoint Manager	Version 12.23.0 quick_fix1
Blackberry Unified Endpoint Manager	Version 12.23.0 quick_fix2
Blackberry Unified Endpoint Manager	Version 12.23.0 quick_fix3
Blackberry Unified Endpoint Manager	Version 12.23.0 quick_fix4
Blackberry Unified Endpoint Manager	Version 12.23.0 quick_fix5
Blackberry Unified Endpoint Manager	Version 12.23.0 quick_fix6
Blackberry Unified Endpoint Manager	Version 12.23.0 quick_fix7
Blackberry Unified Endpoint Manager	Version 12.23.0 quick_fix8

Configuration B

8 vulnerable

Vulnerable Software	Affected Versions
Blackberry Unified Endpoint Manager	Version 12.22.1
Blackberry Unified Endpoint Manager	Version 12.22.1 quick_fix1
Blackberry Unified Endpoint Manager	Version 12.22.1 quick_fix2
Blackberry Unified Endpoint Manager	Version 12.22.1 quick_fix3
Blackberry Unified Endpoint Manager	Version 12.22.1 quick_fix4
Blackberry Unified Endpoint Manager	Version 12.22.1 quick_fix5
Blackberry Unified Endpoint Manager	Version 12.22.1 quick_fix6
Blackberry Unified Endpoint Manager	Version 12.22.1 quick_fix7

Related CWEs

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

References (1)

https://support.blackberry.com/pkb/s/article/141208

Source: secure@blackberry.com

Vendor Advisory

Timeline

No history available yet.