Is CVE-2026-8152 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8152 being exploited in the wild.

How severe is CVE-2026-8152?

Informational severity, with a CVSS score of 9.3, published 22 July 2026.

Which products and versions are affected?

Unblu Spark 8.36.1 and all earlier versions.

Is there a fix for CVE-2026-8152?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-8152 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-8152?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8152: Unblu Spark DOM-based XSS via redirectOnFailure parameter

CVE-2026-8152 · Severity: info · CVSS 9.3 · Published 2026-07-22

Unblu Spark, a platform for customer engagement and collaboration, contains a security flaw in how it handles web redirects. An attacker can trick a user into clicking a malicious link that executes unauthorized code within their browser session. In certain configurations where Unblu is deeply integrated into a company's main website, this could allow an attacker to steal sensitive session cookies, access private user data, or perform actions on behalf of the user across the entire host application.

Quick answers

Is CVE-2026-8152 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8152 being exploited in the wild.
How severe is CVE-2026-8152?: Informational severity, with a CVSS score of 9.3, published 22 July 2026.
Which products and versions are affected?: Unblu Spark 8.36.1 and all earlier versions.
Is there a fix for CVE-2026-8152?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-8152 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-8152?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An open redirect vulnerability exists in Unblu Spark due to insufficient validation of the 'redirectOnFailure' URL parameter. This parameter is not passed through the standard redirect filter, allowing an attacker to use the 'javascript:' scheme to execute arbitrary code in the victim's browser (DOM-based XSS). The impact is significantly escalated when 'com.unblu.identifier.siteEmbeddedSetup' is set to true, as the application then shares the same origin as the host application. In this configuration, the injected script can access the host application's cookies, DOM, and same-origin APIs. The vulnerability is fixed in version 8.36.1-hotfix.0 and 8.37.0.

Affected products

Unblu Spark 8.36.1 and all earlier versions

Timeline

2026-07-22: advisory
2026-07-22: disclosed

References

https://docs.unblu.com/latest/security-bulletins/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.