CVE-2026-8152
CriticalCVSS 9.3Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based XSS attack. When deployed with a specific configuration, it runs in the same origin as the host application, allowing an attacker full access to its resources.
Risk Assessment
The risk is critical for on-premises deployments with this configuration, as an attacker can compromise cookies, DOM, and APIs of the host application, leading to full compromise.
Recommendation
Immediately update Unblu Spark to a patched version and review the siteEmbeddedSetup configuration.
Other vulnerabilities in Unblu Spark
See all- CVE-2026-14933High
In the embedded co-browsing feature in Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2 (on-premises and cloud), an unauthenticated remote attacker in the visitor role can execute arbitrary JavaScript in the browser of an agent participating in the attacker's co-browsing session, via content rendered as HTML. The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or Single Conversation Desk. Exploitation requires an agent to join a session with the attacker; mobile co-apping is not affected.
- CVE-2026-9589Critical
Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments. An authenticated remote attacker can read and change configuration properties of entities they aren't authorized to access, including other users, accounts, and in Unblu Cloud other customers' accounts.
Original NVD description (English source)
Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS