CVE-2026-18085

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service.

CVSS v3 6.9 MEDIUM

6.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 4.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://support.blackberry.com/pkb/s/article/141208	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:-::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix1::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix2::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix3::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix4::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix5::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix6::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix7::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix8::::::

Configuration 2 (hide)

OR	cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:-::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix1::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix2::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix3::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix4::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix5::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix6::::::
	cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix7::::::

History

No history.

Information

Published : 2026-07-28 17:16

Updated : 2026-08-14 13:47

NVD link : CVE-2026-18085

Mitre link : CVE-2026-18085

CVE.ORG link : CVE-2026-18085

JSON object : View

Products Affected

blackberry

unified_endpoint_manager

CWE

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

{"id": "CVE-2026-18085", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18085", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T16:53:31.439139Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.7, "exploitabilityScore": 1.6}], "cvssMetricV40": [{"type": "Secondary", "source": "secure@blackberry.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "secure@blackberry.com", "affectedData": [{"vendor": "BlackBerry", "modules": ["Management Console"], "product": "UEM", "versions": [{"status": "affected", "version": "12.23.0 QF8 and earlier, 12.22.1 QF7 and earlier"}], "defaultStatus": "affected"}]}], "published": "2026-07-28T17:16:38.150", "references": [{"url": "https://support.blackberry.com/pkb/s/article/141208", "tags": ["Vendor Advisory"], "source": "secure@blackberry.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "secure@blackberry.com", "description": [{"lang": "en", "value": "CWE-74"}]}], "descriptions": [{"lang": "en", "value": "An Improper Input Validation in the BlackBerry UEM\u00a0Management\u00a0Console\u00a0of\u00a0BlackBerry UEM\u00a012.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service."}], "lastModified": "2026-08-14T13:47:50.927", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0828177A-19A0-40F3-A954-6DF6A2AB2D4D"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DAAB615-AB15-428B-B7AB-BA3FC40AAC0B"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A7DAE980-128C-43E0-9419-ADA98052DCAD"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68019BC8-2EC0-418E-A36D-DA9986E9F9AC"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "08B40088-A7B5-4FF2-BB55-66B549AA0256"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A60E9BDB-2473-499C-88F5-4D77BBA8D389"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68C20984-33EB-444E-9EC3-C8FD5704B538"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B7F79521-495C-4764-8525-80BC0D2F022C"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.23.0:quick_fix8:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB0A040F-5129-4F13-B570-5D1A5867F8CD"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DE316006-38A5-4F46-B664-60509A1B4E76"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7F5E5F2F-086D-4261-AD86-694E9D309950"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "687E2E4B-2841-43A6-BDE7-8ADD2E12E0D8"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "42AD8DCE-F74A-410B-B15F-B52878472E5B"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0AF32244-BA24-4BE7-9685-72050706E579"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65450C05-0C20-4DF1-BF69-655CA2370D99"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1B88E9F9-9267-4D8E-8CB3-FE88F950BF22"}, {"criteria": "cpe:2.3:a:blackberry:unified_endpoint_manager:12.22.1:quick_fix7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6499E219-07C8-4003-97E5-08CCEACF6377"}], "operator": "OR"}]}], "sourceIdentifier": "secure@blackberry.com"}