Medium severity · published Jul 28, 2026
CVE-2026-18085
Improper Input Validation Leads to Arbitrary File Download and Potential Denial of Service in BlackBerry UEM
6.9
CVSS
0.3%
EPSS
No
On KEV
Description
An Improper Input Validation in the BlackBerry UEM Management Console of BlackBerry UEM 12.23.0 QF8 and earlier allows Arbitrary File Download and Potential Denial of Service.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UE
UEM · BlackBerry
12.23.0 QF8 and earlier, 12.22.1 QF7 and earlier · source: vendor
UE
Unified Endpoint Manager · Blackberry
12.23.0; 12.23.0; 12.23.0; 12.23.0; 12.23.0; 12.23.0; +11 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-18085
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-18085
Vendor Advisory
https://support.blackberry.com/pkb/s/article/141208
More from UEM
6.1
CVE-2026-18084
Cross-Site Scripting (XSS) in Management Console of BlackBerry UEM