A Cross-Site Scripting vulnerability in the BlackBerry UEM Management Console could allow an unauthenticated attacker to execute arbitrary scripts in a user's browser session.

This is a Cross-Site Scripting (XSS) vulnerability caused by improper input sanitization within the management console. The vulnerability is exploitable by an unauthenticated attacker via a network vector, requiring user interaction to execute malicious scripts.

Successful exploitation of this XSS vulnerability could lead to the theft of session cookies, sensitive information disclosure, or unauthorized actions performed on behalf of an authenticated administrator. With a CVSS score of 8.6, this flaw poses a significant risk to the integrity and confidentiality of the management interface, potentially allowing attackers to escalate privileges or compromise the entire UEM environment.

Immediate Action: Upgrade BlackBerry UEM to the versions provided in the official vendor advisory (KB Article 141208).

Proactive Monitoring: Review web server and management console access logs for suspicious input patterns or unusual script-based payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict XSS filtering rules to detect and block malicious injection attempts aimed at the UEM console.

Public Exploit Available: Unknown

Given the high CVSS severity and the critical nature of BlackBerry UEM in managing enterprise mobile devices, organizations should prioritize patching these instances immediately. Failure to update may expose the management console to unauthorized session hijacking and administrative compromise.