EUVD-2026-49897
GHSA-xxhj-c62m-3wgm
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible console requires active user interaction (UI:R) and high complexity (AC:H); no confidentiality impact per vendor VC:N assessment; high availability impact consistent with DoS finding and VA:H in source vector.
Primary rating from Vendor (blackberry).
CVSS VectorVendor: blackberry
Lifecycle Timeline
1DescriptionCVE.org
An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service.
AnalysisAI
Improper input validation in the BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier, and 12.22.1 QF7 and earlier) enables unauthenticated remote attackers to trigger arbitrary file download operations and a potential denial of service condition against the console when a Management Console user interacts with attacker-influenced content. The CVSS 4.0 vector reflects high availability impact on the vulnerable system (VA:H) with residual integrity and availability effects on subsequently managed systems (SI:L/SA:L), though the vendor rates confidentiality impact as none (VC:N) - a notable discrepancy given the 'Arbitrary File Download' language in the description that warrants vendor clarification. No public exploit code or active exploitation has been identified; EPSS places this at the 11th percentile (0.21%) and SSVC independently assesses exploitation as none with a non-automatable attack path.
Technical ContextAI
BlackBerry UEM (Unified Endpoint Management) is an enterprise MDM platform used primarily in government, healthcare, and financial sectors to manage mobile devices and endpoints. The Management Console is a web-based administrative interface that is the target of this vulnerability. The root cause is classified as CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component - Injection), indicating that user-controlled input containing special elements is passed unsanitized into a downstream processing component. This is consistent with SSRF-adjacent or path-manipulation injection patterns where the console can be directed to fetch or download arbitrary files, potentially exhausting server resources. The affected CPE is cpe:2.3:a:blackberry:uem:*:*:*:*:*:*:*:*, covering the full UEM product line up to the stated fix boundary. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:A) confirms network accessibility but requires active user interaction and high attack complexity, indicating exploitation depends on specific console usage patterns or an administrator interacting with attacker-crafted content rather than a fully passive remote exploit.
RemediationAI
Organizations should upgrade BlackBerry UEM beyond the affected releases - past 12.23.0 QF8 on the 12.23.x branch and past 12.22.1 QF7 on the 12.22.x branch - by applying the latest Quarterly Fix from BlackBerry per the advisory at https://support.blackberry.com/pkb/s/article/141208. A specific patched version number was not independently confirmed in the available intelligence data; consult the advisory directly for the exact target QF designation before upgrading. Where immediate patching is not feasible, restrict network access to the UEM Management Console to trusted administrative segments only using firewall rules or VPN enforcement, reducing the network-accessible attack surface (AV:N). Additionally, disable or limit any Management Console features that permit external file retrieval or URL-based operations, and monitor console access logs for anomalous file-access or availability events. Network-layer restriction is the most actionable compensating control given the console's administrative criticality, though it does not eliminate risk if the attacker can reach the management network.
More in Blackberry
View allWhen using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Rate
/sbin/ifwatchd in BlackBerry QNX Neutrino RTOS 6.4.x and 6.5.x allows local users to gain privileges by providing an arb
Stack-based buffer overflow in a certain decryption function in qconnDoor on BlackBerry Z10 devices with software 10.1.0
An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. Rated medium severity (CVSS 6.5), this
Multiple SQL injection vulnerabilities in the com.rim.mdm.ui.server.ImageServlet servlet in BlackBerry Enterprise Server
Stack-based buffer overflow in the bpe_decompress function in (1) BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 and (2)
Multiple cross-site scripting (XSS) vulnerabilities in BlackBerry Enterprise Server 12 (BES12) Self-Service before 12.4
BlackBerry Link before 1.2.1.31 on Windows and before 1.1.1 build 39 on Mac OS X does not require authentication for rem
The Storage and Access service in BlackBerry OS 10.x before 10.2.1.1925 on Q5, Q10, Z10, and Z30 devices does not enforc
Buffer overflow in phrelay in BlackBerry QNX Neutrino RTOS through 6.5.0 SP1 in the QNX Software Development Platform al
A security vulnerability in the PCX image codec in QNX SDP (CVSS 9.8) that allows an unauthenticated attacker. Critical
A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute o
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today