Loading story…
BlackBerry UEM Management Console is affected by CVE-2026-18084, a high-severity cross-site scripting flaw caused by improper neutralization of the time zone parameter during web page generation. The vulnerability impacts BlackBerry UEM 12.23.0 QF8 and earlier, with affected release history also including 12.22.1 QF7 and earlier; advisories describe systems prior to QF9 as vulnerable. An unauthenticated remote attacker can inject malicious JavaScript that executes when an authenticated administrator loads the affected page.
Successful exploitation can lead to session token theft, full takeover of the UEM console, unauthorized policy changes, exposure of sensitive corporate data, malicious configuration changes on enrolled devices, and potential lateral movement into the broader enterprise network. BlackBerry has advised customers to upgrade to QF9 or later immediately, while defenders are also being urged to restrict management console access, enforce MFA, and monitor logs for anomalous activity that could indicate exploitation attempts.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
BlackBerry published an advisory for CVE-2026-18084, a CWE-79 cross-site scripting flaw in the BlackBerry UEM Management Console involving the time zone parameter. The issue affects BlackBerry UEM 12.23.0 QF8 or earlier, with remediation guidance pointing customers to QF9 or later.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
cert.ug
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ivanti has disclosed a critical vulnerability (CVE-2025-10573) in its Endpoint Manager (EPM) software, which allows unauthenticated remote attackers to execute arbitrary JavaScript code via a stored cross-site scripting (XSS) attack. The flaw enables attackers to register fake managed endpoints to the EPM server, thereby injecting malicious JavaScript into the administrator web dashboard. When an administrator interacts with the compromised dashboard, the attacker can hijack the session and potentially gain full control over the EPM environment. Ivanti has released a patch (EPM 2024 SU4 SR1) to address this issue and strongly urges customers to update, especially since hundreds of EPM instances are exposed to the internet, increasing the risk of exploitation. The vulnerability, assigned a CVSS score of 9.6, affects EPM versions 2024 SU4 and below. Security researchers at Rapid7, who discovered and reported the flaw, emphasize the urgency of patching due to the unauthenticated nature of the attack vector. Ivanti EPM is widely used for endpoint management, remote administration, and compliance, making it a high-value target for attackers. In addition to CVE-2025-10573, Ivanti has also released fixes for three other high-severity vulnerabilities in the same update cycle. Security teams are advised to apply the latest patches immediately and review the exposure of EPM instances to the internet to mitigate the risk of compromise.
Jun 29, 2026
Check Point disclosed **`CVE-2026-16232`**, a high-severity SmartConsole authentication bypass affecting **Security Management**, **Multi-Domain Management**, **Firewall**, and **Multi-Domain Log Server** products across multiple versions. The flaw, rated **CVSS 9.3**, allows attackers to bypass SmartConsole login using an application token, and Check Point said it has already been exploited against a small number of customers with specific exposed configurations. Check Point released fixes for `CVE-2026-16232` along with related flaws **`CVE-2026-62144`** and **`CVE-2026-62145`**, while the Canadian Centre for Cyber Security issued advisory **AV26-735** urging organizations to review the vendor guidance and apply mitigations. The highest risk is for management interfaces exposed directly to the internet without IP restrictions, and defenders were advised to install the available jumbo hotfix, restrict trusted GUI clients by IP address, and place management access behind a firewall until patching is complete.
Aug 15, 2026
Attackers are actively exploiting **CVE-2026-20230**, a critical flaw in Cisco Unified Communications Manager (**Unified CM**) and Unified CM Session Management Edition (**Unified CM SME**), shortly after technical details and proof-of-concept code became public. Cisco said the bug stems from improper input validation in certain HTTP requests and can let an unauthenticated attacker perform **SSRF**, write arbitrary files to the underlying operating system, and potentially escalate privileges to **root**; researchers also described a path to unauthenticated remote code execution. Exploitation requires the **WebDialer** service to be enabled, although Cisco notes it is disabled by default. Exploit intelligence firm Defused reported seeing attacks from a single source using an unvetted PoC, with `file://` file-write payloads observed against decoy systems over the weekend. Cisco patched the issue in **Unified CM 14SU6** and **15SU5**, while SSD Secure Disclosure, which reported the vulnerability, published additional technical details showing how attackers could recover a target's true hostname and progress toward code execution. Cisco has advised customers to apply the fixes and, if patching cannot be done immediately, disable **WebDialer** to reduce exposure on widely deployed enterprise voice platforms.
Aug 15, 2026