Vulnerability record/PUBLISHED/Published Nov 6, 2026 07:50:49 UTC

CVE-2026-65022

The MDM App Catalog / App Store preview does not properly sanitize or encode user-supplied HTML before rendering it. Injected HTML can be displayed to users who view the preview, which may allow cross-site scripting (XSS) when a user interacts with the crafted content.

Base score6.3/ 10

SeverityMediumCVSS 3.1

Exploitability / impact

CVSS metric breakdown

Vector-derived attributes

Base severityMedium

Attack vectorNetworkAV

Attack complexityLowAC

Privileges requiredLowPR

User interactionRequiredUI

ScopeUnchangedS

Confidentiality impactHighC

Integrity impactLowI

Availability impactNoneA

CVSS vector stringCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

CVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.

Record context

CVE Numbering AuthorityHCL

Last updatedNov 6, 2026 07:50:49 UTC

PublishedNov 6, 2026 07:50:49 UTC

ReservedJul 21, 2026 13:42:03 UTC