EUVD-2026-66775
GHSA-m7xh-693m-jh6h
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
AV:L and PR:H confirmed by local admin requirement; C:L added to reflect description's explicit sensitive information disclosure outcome, correcting apparent C:N understatement.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL BigFix Quantum Risk Analyzer is affected by a hardcoded external resource reference and a lack of binary integrity which could allow an attacker to obtain sensitive information or modify the binary.
AnalysisAI
HCL BigFix Quantum Risk Analyzer contains a hardcoded external resource reference combined with absent binary integrity verification, exposing the product to binary substitution attacks and potential sensitive information disclosure. The affected CPE covers all versions of the product under hclsoftware. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local access to the host running HCL BigFix Quantum Risk Analyzer with high-privilege (administrative) credentials, as confirmed by the CVSS vector AV:L/PR:H. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) scores 4.4 Medium, reflecting a meaningful but locally-scoped integrity risk requiring high privileges. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the HCL vendor advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133289 for the official patch or updated release version; no exact fixed version number is derivable from the available data, so patch availability per vendor advisory is the most specific status that can be confirmed. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Bigfix Quantum Risk Analyzer
View allSame weakness CWE-494 – Download of Code Without Integrity Check
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today