Bigfix Platform CVE-2026-21765

Requires local access to Windows host running HCL BigFix Platform. Attacker needs low-privilege user account to access private cryptographic key files with overly permissive permissions. No user interaction required.

Real-world risk is significant for organizations deploying HCL BigFix on Windows platforms. The CVSS 8.8 rating accurately reflects a serious threat: local attack vector (AV:L) requires the attacker already have system access, but low attack complexity (AC:L) and no user interaction (UI:N) mean exploitation is straightforward once an attacker obtains low-privilege credentials (PR:L). The scope change to high impact across confidentiality, integrity, and availability (S:C/C:H/I:H/A:H) indicates compromised keys could enable lateral movement, data exfiltration, or disruption of endpoint management across the enterprise. No EPSS score provided, but the low complexity and automatable nature suggest this would be attractive for post-compromise privilege escalation in targeted attacks. Absence from CISA KEV and no identified public exploit code reduces immediate urgency compared to internet-facing vulnerabilities, but the high CVSS and enterprise deployment context make this a priority for organizations using BigFix on Windows. The vulnerability is particularly concerning in shared Windows environments or where insider threats exist, as authenticated access is the only prerequisite.

An attacker with low-privilege credentials on a Windows server running HCL BigFix Platform (such as a compromised user account or foothold from phishing) enumerates file system directories and discovers private cryptographic keys with world-readable permissions. The attacker extracts these keys and uses them to impersonate BigFix infrastructure components, issue fraudulent management commands to endpoints across the organization, decrypt sensitive inventory data collected from managed systems, or sign malicious payloads that will be trusted by the endpoint agent deployment infrastructure. This enables lateral movement, data exfiltration, and potential ransomware deployment across the managed endpoint estate.