BlackBerry UEM Security Bulletin: Multiple CVEs (Arbitrary File Download/XSS)

Vulnerability Overview Vulnerability ID: BSRT-2026-001 Release Date: June 30, 2026 Vulnerability Type: - CVE-2026-18065: Improper input validation leading to arbitrary file download and potential service denial - CVE-2026-18064: Cross-site scripting (XSS) Affected Products Affected Products: - BlackBerry UEM 12.23.0 QFB and earlier versions - BlackBerry UEM 12.22.1 QF7 and earlier versions Non-Affected Products: All other BlackBerry products Remediation Solution: Install BlackBerry UEM 12.23.0 QF10 or 12.22.1 QF8 Vulnerability Details CVE-2026-18065 CVSSv4 Score: 5.9 Affected Component: BlackBerry UEM Management Console Attacker Requirements: The attacker must convince a user to visit a malicious web page or click a malicious link Impact: May result in limited service denial on the server or potential download of malicious files Mitigations: No known mitigations CVE-2026-18064 CVSSv4 Score: 8.6 Affected Component: BlackBerry UEM Management Console Attacker Requirements: The attacker must convince a user to visit a malicious web page or click a malicious link Impact: May result in execution of malicious code in the victim's browser Mitigations: No known mitigations Additional Information Definitions: - CVE: Common Vulnerabilities and Exposures - CVSS: Common Vulnerability Scoring System - Mitigations: Conditions that reduce the likelihood of a successful attack - Workarounds: Settings or configuration changes that can be applied by administrators or users Acknowledgments: Thanks to Christian Becker of Y-Security for their contribution to helping protect customers. Legal Disclaimer: All data and information are provided for informational purposes only and do not come with any warranty or guarantee.

Goal Reached Thanks to every supporter — we hit 100%!

BlackBerry UEM Security Bulletin: Multiple CVEs (Arbitrary File Download/XSS)