EUVD-2026-66806
GHSA-2vm7-fvj4-mcvr
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N
Local access and high privileges required to read log files; impact is confidentiality-only as verbose logs expose data without enabling modification or service disruption.
Primary rating from Vendor (hcl).
CVSS VectorVendor: hcl
Lifecycle Timeline
1DescriptionCVE.org
HCL BigFix Quantum Risk Analyzer generates highly detailed logging information by default which increases the risk of sensitive data leakage and can provide an attacker with internal application logic and architectural details.
AnalysisAI
HCL BigFix Quantum Risk Analyzer exposes sensitive internal application data through excessively verbose default logging, classified under CWE-532. The CVSS vector (AV:L/PR:H) confirms exploitation requires local, privileged access to the host system - a meaningful barrier that confines risk to insider threats or post-compromise scenarios rather than remote attack. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires both local system access (AV:L) and high privileges (PR:H) as confirmed by the CVSS vector - the attacker must already control a highly privileged account on the host running BigFix Quantum Risk Analyzer, such as a local administrator or equivalent service account. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS score of 4.1 (Medium) accurately reflects a tightly constrained threat profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult HCL support knowledge base article KB0133289 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133289 for vendor-specific remediation guidance, including any available patch or configuration update. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today