Medium severity · published Aug 11, 2026
CVE-2026-18247
DOM-Based Cross-Site Scripting in BlackBerry AtHoc Web Portals
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
A Cross Site Scripting (XSS) vulnerability in the Web Portals of AtHoc IWS in versions earlier than 7.21 HF-734 could allow an attacker to potentially execute actions in the context of the victim's session.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BA
BlackBerry AtHoc IWS · BlackBerry
before 7.21 HF-734 · source: vendor