CVE-2026-65022: BigFix Mobile is affected by a Cross-site scripting vulnerability

Published Nov 6, 2026

Updated

The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user interacts with the crafted content.

Event History

Nov 6, 2026

CVE Published

via MITRE·07:50 AM

Data Sourced

via MITRE·07:50 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to the injected content?

Users who view the MDM App Catalog or App Store preview can be exposed to injected HTML. XSS may occur when a user interacts with the crafted content.

What does an attacker need to exploit this issue?

The attacker needs to provide crafted HTML through a user-supplied input that is rendered in the preview. The supplied HTML is not properly sanitized or encoded before display.

CVE-2026-65022: BigFix Mobile is affected by a Cross-site scripting vulnerability

Event History

Frequently Asked Questions

Who is exposed to the injected content?

What does an attacker need to exploit this issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to the injected content?

What does an attacker need to exploit this issue?