CVE-2026-18085

Severity CVSS v4.0:

MEDIUM

Type:

CWE-74 Injection

Publication date:

28/07/2026

Last modified:

28/07/2026

Description

An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service.

Impact

Vector 4.0

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L CVSS v4.0 Severity and Metrics:

Base Score: 5.90 MEDIUM
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L

Attack Vector (AV): Network
Attack Complexity (AC): High
Attack Requirements (AT): None
Privileges Required (PR): None
User Interaction (UI): Active
Confidentiality (VC): None
Integrity (VI): None
Availability (VA): High
Confidentiality (SC): None
Integrity (SI): Low
Availability (SA): Low

Base Score 4.0

5.90

Severity 4.0

MEDIUM

References to Advisories, Solutions, and Tools

https://support.blackberry.com/pkb/s/article/141208