EUVD-2026-66757
GHSA-5frw-h466-x38v
Severity by source
AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Local high-privilege requirement limits access; only confidentiality impact applies - error messages disclose internals but do not enable direct integrity or availability compromise.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL BigFix Quantum Risk Analyzer has a certain validation process that provides overly descriptive error messages when it encounters malformed input which can allow an attacker to conduct more efficient reconnaissance and fine-tune automated fuzzing tools to produce valid input.
AnalysisAI
HCL BigFix Quantum Risk Analyzer leaks internal system details through overly verbose error messages returned during input validation, enabling attackers with local high-privileged access to conduct more efficient reconnaissance against the platform. By submitting malformed inputs and observing descriptive error responses, an adversary can map internal validation logic and fine-tune automated fuzzing tools to generate valid payloads for follow-on exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local system access with high privileges (AV:L/PR:H per CVSS), meaning the attacker must already hold an elevated account on the host or hold administrative credentials within the BigFix Quantum Risk Analyzer application itself. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 3.9 (Low) accurately reflects constrained real-world risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult HCL's knowledge base article KB0133289 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133289 for the vendor-recommended patch or configuration fix; a specific patched version number is not independently confirmed from available data and must be obtained directly from the advisory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bigfix Quantum Risk Analyzer
View allSame weakness CWE-209 – Error Message Information Leak
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today