BigFix Platform CVE-2026-108013

Requires a BigFix Platform installation still using a Mozilla CA certificate bundle dated before 2026/10/20 (fixed bundle ships with BES Support v1520+). The attacker must (1) occupy an on-path / man-in-the-middle position on the network between BigFix and the remote servers it validates, and (2) possess or use a server certificate whose private key is among the known-compromised keys that the outdated bundle still trusts. Exploitation only occurs when the application validates a server and downloads files (the UI:R/user-or-app-triggered condition). Limiting factors: the stale-bundle precondition, the required privileged on-path position, and the dependency on a specific compromised-key certificate all substantially raise the bar (reflected in AC:H); it is not exploitable against installations already on the 2026/10/20+ bundle.

This is a moderate-severity transport-security flaw, not an urgent priority. The vendor CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N = 6.8) is internally coherent with the description: AV:N reflects a network-based on-path attacker, PR:N means no credentials are needed, but AC:H and UI:R correctly capture that the attacker must already occupy a privileged on-path position AND possess a certificate whose private key is among the known-compromised set still trusted by the stale bundle, while the victim application must perform a server validation/download. No EPSS score, no CISA KEV listing, and no PoC reference are present in the input, so there is no evidence of active exploitation or available exploit code. The vuln.today Decision label is 'this_month' (not act_now/emergency), which aligns with the high-complexity, no-active-exploitation picture: patch on a normal cycle rather than treat as a fire. Signals are consistent - no conflict between CVSS, decision label, and exploitation signals - so this reads as a genuine but conditional, non-widespread risk rather than a high-CVSS-but-overstated issue or a low-CVSS-but-dangerous one.

An attacker who already holds a man-in-the-middle position on the network path between a BigFix Platform component and a remote server presents a TLS certificate signed with a known-compromised private key that the outdated (pre-2026/10/20) Mozilla CA bundle still trusts. BigFix accepts the impersonated server as legitimate and the attacker substitutes or tampers with files the application downloads. No public exploit code or PoC reference is provided in the input, so no public exploit is identified at time of analysis.