BlackBerry UEM CVE-2026-18084

Exploitation targets the BlackBerry UEM Management Console (the web admin interface) and requires an authenticated administrator to interact with attacker-supplied content (CVSS UI:A) - e.g., viewing a crafted record, field, or link that renders the injected script. The attacker themselves is unauthenticated to the injection point (PR:N), but no impact occurs unless a privileged console user triggers the payload, so realistic risk is bounded by admin interaction and access to the console (typically an internal/restricted management network). Affects UEM 12.23.0 QF8 and earlier and 12.22.1 QF7 and earlier.

Signals converge on MODERATE, not critical, real-world risk despite the 8.6 vendor score. The vendor-supplied CVSS 4.0 vector rates all three vulnerable-system impacts High (VC:H/VI:H/VA:H), which is aggressive for a reflected/stored XSS whose script executes only in the victim's browser - a management-console session, not the server itself. Mitigating signals: UI:A means the attack fires only when an authenticated admin actively interacts with attacker-supplied content; EPSS is low at 0.26% (17th percentile); SSVC records Exploitation: none and Automatable: no; and there is no CISA KEV entry and no public exploit code. SSVC's 'Technical Impact: total' reflects that hijacking an admin's console session can yield full administrative control, which is the real concern here rather than mass automated exploitation. Conflict to flag: the vendor's VA:H (availability) rating is hard to justify for XSS - script injection does not typically deny service - so the raw score likely overstates severity; treat this as a targeted-admin-compromise risk, not a wormable network threat. No CVSS 3.1 vector was supplied, only CVSS 4.0.

An attacker crafts a malicious link or payload that, when viewed by an authenticated BlackBerry UEM administrator in the Management Console, executes attacker-controlled JavaScript in the admin's authenticated session. The script can then steal the session/CSRF tokens or drive console actions to escalate control over managed devices. No public exploit code has been identified, and the attack requires the admin to interact with the crafted content (UI:A).