Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's upload functionality and, if the payload is subsequently triggered, achieve code execution and full server compromise. The public description characterizes the actor as unauthenticated, while the vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) requires a low-privileged authenticated account plus user interaction at high attack complexity; our own independent assessment scores it AV:N/AC:L/PR:N/UI:N with high confidentiality, integrity, and availability impact, so the two views differ by both privilege requirement and severity and must be reconciled before prioritization. Exploitation is limited to deployments that expose the vulnerable upload feature and whose validation controls can be bypassed, and there is no public exploit identified at time of analysis.
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple simultaneous authenticated sessions for the same admin account, which can make valid session identifiers predictable or hijackable. A remote unauthenticated attacker could exploit this only if a privileged administrator has an active session and the attacker can predict or obtain that session identifier, then act with full administrative permissions; the vendor rates it 9.8, but the independent assessment raises attack complexity to high because that session-identifier step is a significant prerequisite. No public exploit identified at time of analysis, EPSS is low at 0.15% (5th percentile), and SSVC reports no exploitation and not automatable, so active exploitation is not confirmed.