Is there a patch available for CVE-2026-18247?

Yes, a patch is available for CVE-2026-18247. Update the affected software to the latest version immediately.

AtHoc IWS CVE-2026-18247

Q: What is the CVSS score of CVE-2026-18247?

CVE-2026-18247 has a CVSS 4.0 base score of 5.3 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-56218 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-11 blackberry

GHSA-7mpx-rcg7-4jw2

XSS Blackberry Blackberry Athoc Iws

5.3

CVSS 4.0 · Vendor: blackberry

Severity by source

Vendor (blackberry) PRIMARY

5.3 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.1 MEDIUM

Network-delivered XSS requiring user interaction; scope changes to victim's session context; no availability impact identified.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (blackberry).

CVSS VectorVendor: blackberry

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 17:02 EUVD

Analysis Generated

Aug 11, 2026 - 16:50 vuln.today

DescriptionCVE.org

A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session.

AnalysisAI

Cross-site scripting in BlackBerry AtHoc IWS Web Portals allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the context of an authenticated victim's session. All versions of AtHoc IWS prior to 7.21 HF-734 are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms no special attacker privileges are needed, though a user interaction step is required, limiting mass-scale opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation) indicates the Web Portals component of AtHoc IWS fails to sanitize or encode user-supplied input before rendering it in browser responses. BlackBerry AtHoc IWS (Intelligent Warning System) is a crisis communications and emergency mass notification platform used by government agencies, defense organizations, and large enterprises. The CPE string cpe:2.3:a:blackberry:blackberry_athoc_iws:*:*:*:*:*:*:*:* confirms all variants of the product line are affected up to the patched release. The vulnerability resides specifically in the Web Portals interface - the browser-facing component used by portal operators or end users - making session-context exploitation the primary risk.

RemediationAI

Upgrade BlackBerry AtHoc IWS to version 7.21 HF-734 or later, as documented in the vendor advisory at https://support.blackberry.com/pkb/s/article/141248. This is the only confirmed fix; no alternative patch version is identified. Where immediate upgrading is not feasible, restrict access to the Web Portals interface to trusted internal networks or VPN only, reducing the attacker's ability to deliver a crafted payload to victim users - though this trades portal accessibility for a meaningful reduction in attack surface. Additionally, enabling strict Content Security Policy (CSP) headers at the reverse proxy or load balancer layer can reduce XSS execution impact even if injection occurs. Neither workaround eliminates the underlying vulnerability; patching remains the definitive remediation.