BlackBerry UEM EUVD-2026-49897

The attacker requires network access to the BlackBerry UEM Management Console (typically HTTPS on port 443 or a vendor-specified management port) running version 12.23.0 QF8 or earlier, or 12.22.1 QF7 or earlier. Critically, active user interaction is required (UI:A in the CVSS 4.0 vector) - a Management Console user, typically an administrator, must perform an action such as clicking a crafted link or submitting attacker-influenced input through the console interface. No prior authentication is required from the attacker's side (PR:N), but high attack complexity (AC:H) means the conditions for successful exploitation are not trivially reproducible and the attack is assessed as non-automatable by SSVC. Factors limiting exploitation include: mandatory administrator interaction that requires social engineering, high attack complexity reducing reliable weaponization, management console networks typically gated behind VPN or internal segmentation, and the complete absence of confirmed public exploit code or observed active exploitation.

Real-world risk is moderate-to-low despite the injection classification. The CVSS 4.0 base score of 5.9 reflects high availability impact (VA:H) with minor subsequent system effects (SI:L/SA:L), but no confidentiality impact (VC:N). This conflicts with the description's explicit mention of 'Arbitrary File Download,' which typically implies data exfiltration; either the files accessible are non-sensitive in this context, or the primitive involves the server fetching external resources rather than exposing internal data - this should be verified with the vendor before assuming no data exposure risk. EPSS at 0.21% (11th percentile) indicates very low exploitation probability across the broader threat landscape. SSVC independently assesses exploitation as none and the attack as non-automatable, aligning with the AC:H/UI:A constraints in the vector. No active exploitation (KEV) and no known public exploit further reduce urgency. However, for organizations relying on BlackBerry UEM, a denial of service against the Management Console - the central control plane for endpoint policy enforcement - carries meaningful operational risk even at moderate severity scores, particularly in regulated environments where endpoint compliance is mandatory.

An attacker identifies a BlackBerry UEM deployment with the Management Console accessible over the network and crafts a malicious link or web resource containing specially constructed input targeting the CWE-74 injection flaw. The attacker socially engineers a console administrator into interacting with the content - for example, by clicking a crafted URL - which causes the console to process unsanitized input, triggering arbitrary file download operations or exhausting server resources and resulting in a denial of service for the management plane with residual disruption to managed endpoint policy enforcement. No public exploit code has been identified for this scenario at time of analysis.