BlackBerry AThoc IWS DOM-based XSS Vulnerability (CVE-2026-18247)

Vulnerability Overview Vulnerability Name: BSRT-2026-002 Cross-Site Scripting Vulnerability in Web Portals Impacts AThoc IWS CVE ID: CVE-2026-18247 Vulnerability Type: DOM-based Cross-Site Scripting (XSS) CVSS v4 Score: 5.3 Release Date: August 12, 2026 Scope of Impact Affected Products: AThoc IWS versions prior to 7.21 HF-734 Affected Components: Web Portals Unaffected Products: All other BlackBerry products Applicable Audience: Administrators deploying AThoc IWS Attacker Requirements: An attacker must persuade a user to visit a malicious webpage or click a malicious link Potential Impact: Successful exploitation allows the attacker to perform actions within the context of the victim's session Remediation Mitigations: Requires an attacker to persuade a user to visit a malicious webpage or click a malicious link Workarounds: No known workarounds Software Update: Customers must contact Customer Support/Professional Services to obtain updates Updated Version: BlackBerry AThoc (OnPrem) 7.21 HF-734 Additional Information Definitions: - CVE: Common Vulnerabilities and Exposures, maintained by MITRE Corporation - CVSS: Common Vulnerability Scoring System, used to communicate vulnerability severity - Mitigations: Existing conditions that reduce the likelihood of a successful attack or limit the severity of an attack - Workarounds: Settings or configuration changes that users or administrators can apply to help protect against an attack Acknowledgments: - Patrick de Neronha aka Ps13ck of Kabuto Security Changelog: - 07-11-2026: Initial release Legal Disclaimer All information is for informational purposes only and provides no warranties or guarantees. BlackBerry is not liable for any direct, indirect, special, punitive, consequential, or incidental damages arising from the use of or reliance on this information.

Goal Reached Thanks to every supporter — we hit 100%!

BlackBerry AThoc IWS DOM-based XSS Vulnerability (CVE-2026-18247)