BigFix Quantum Risk Analyzer CVE-2026-21810

Exploitation requires local access to the host running HCL BigFix Quantum Risk Analyzer with high-privilege (administrative) credentials, as confirmed by the CVSS vector AV:L/PR:H. The attacker must be able to influence the content served at the hardcoded external resource reference - either by compromising the referenced external endpoint, performing a man-in-the-middle on the network path, or having sufficient local access to redirect the reference. The high-privilege requirement is the primary limiting factor: an external network attacker with no foothold on the BigFix host cannot exploit this directly. Default configurations are affected (the hardcoded reference is baked in), but exploitation is not possible without first achieving privileged local access.

The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) scores 4.4 Medium, reflecting a meaningful but locally-scoped integrity risk requiring high privileges. The local attack vector and high privilege requirement significantly narrow the realistic threat population - exploitation is not remotely automatable and demands an already-privileged foothold on the host. One notable discrepancy: the CVSS vector records C:N (no confidentiality impact), yet the CVE description explicitly includes 'obtain sensitive information' as an attack outcome; this conflict should be verified with HCL's advisory at KB0133289, as confidentiality impact may be understated in the score. EPSS data was not provided in the input, so probabilistic exploitation likelihood cannot be quantified. There is no CISA KEV listing and no known public exploit, which is consistent with the high-privilege, local-only attack path. SSVC signals suggest exploitation is unlikely to be automated (local vector, high privileges), technical impact is partial (integrity of one binary), and no scope change occurs. Real-world priority is low for most organizations unless the BigFix environment is multi-tenant or the Quantum Risk Analyzer host is shared with sensitive workloads.

An attacker who has already obtained local administrative access to the BigFix Quantum Risk Analyzer host positions a malicious binary at the hardcoded external resource location - either by compromising the referenced external endpoint or by manipulating local DNS or network routing to redirect the reference. When the application next fetches and loads the external resource without integrity verification, the malicious binary executes in the application's context, achieving code execution or persistent modification. No public proof-of-concept code exists at time of analysis.