A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through…
Priority LOW 39CWE-254Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA.
Summary
A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to enroll an illegitimate device to the BES, gain access to device parameters for the BES, or send false information to the BES by gaining access to specific information about a device that was legitimately enrolled on the BES.
Why it matters now
EPSS 0.01871 79th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | BES12 versions through 12.5.2 | BES12 versions through 12.5.2 | — | No fix listed | CNA |
- BES12 versions through 12.5.2 Vendor— Affected BES12 versions through 12.5.2 Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:blackberry:enterprise_service:12.0.0:*:*:*:*:*:*:* | 12.0.0 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.0.1:*:*:*:*:*:*:* | 12.0.1 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.1.0:*:*:*:*:*:*:* | 12.1.0 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.2.0:*:*:*:*:*:*:* | 12.2.0 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.2.1:*:*:*:*:*:*:* | 12.2.1 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.3.0:*:*:*:*:*:*:* | 12.3.0 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.3.1:*:*:*:*:*:*:* | 12.3.1 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.4.0:*:*:*:*:*:*:* | 12.4.0 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.4.1:*:*:*:*:*:*:* | 12.4.1 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.5.0a:*:*:*:*:*:*:* | 12.5.0a | Vulnerable | BlackBerry |
- cpe:2.3:a:blackberry:enterprise_service:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.0.1:*:*:*:*:*:*:* Versions 12.0.1 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.2.0:*:*:*:*:*:*:* Versions 12.2.0 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.2.1:*:*:*:*:*:*:* Versions 12.2.1 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.3.0:*:*:*:*:*:*:* Versions 12.3.0 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.3.1:*:*:*:*:*:*:* Versions 12.3.1 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.4.0:*:*:*:*:*:*:* Versions 12.4.0 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.4.1:*:*:*:*:*:*:* Versions 12.4.1 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.5.0a:*:*:*:*:*:*:* Versions 12.5.0a Vulnerable ·BlackBerry
Show 2 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:blackberry:enterprise_service:12.5.1:*:*:*:*:*:*:* | 12.5.1 | Vulnerable | BlackBerry |
| cpe:2.3:a:blackberry:enterprise_service:12.5.2:*:*:*:*:*:*:* | 12.5.2 | Vulnerable | BlackBerry |
- cpe:2.3:a:blackberry:enterprise_service:12.5.1:*:*:*:*:*:*:* Versions 12.5.1 Vulnerable ·BlackBerry
- cpe:2.3:a:blackberry:enterprise_service:12.5.2:*:*:*:*:*:*:* Versions 12.5.2 Vulnerable ·BlackBerry
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2016-3128
- 2026-10-03 Alias added: GHSA-94c7-grvp-xm27
References
More BlackBerry Enterprise Service vulnerabilities
- TI-2016-02624 Information disclosure in BES12 versions through 12.5.2 CVSS 3.0HIGH 8.1
- TI-2017-02990 Cross-site scripting in BlackBerry Unified Endpoint Manager CVSS 3.0MEDIUM 6.1
Sources
- CVE-2016-3128 · CVE Program
- CVE-2016-3128 · NVD
- FIRST EPSS
- GHSA-94c7-grvp-xm27 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences