HCL BigFix SCM Reporting CVE-2026-21821

Exploitation requires (1) the victim to be an authenticated BigFix SCM Reporting operator who loads attacker-controlled content - either by clicking a crafted URL pointing at the reporting site or by viewing a report whose data fields the attacker has poisoned upstream (e.g., via a controlled endpoint name, fixlet content, or query parameter), reflecting the UI:R and AC:H markers in the CVSS vector; (2) a reachable DOM sink in BigFix's use of jQuery 1.x - the CVE asserts the library is present but does not enumerate which specific child weakness is exploitable in this codebase; and (3) network reachability to the reporting site, which in most deployments is restricted to internal administrative networks rather than internet-exposed. PR:N indicates the attacker themselves need not authenticate, but the targeted user must have an active session.

Signals conflict sharply. CVSS 8.3 is driven by the AV:N/S:C/C:H/I:H/A:H combination - scope change plus high triad impact - but is tempered by AC:H and UI:R, meaning the attacker needs specific conditions and a victim click. EPSS is 0.04% (13th percentile) and SSVC reports Exploitation: none and Automatable: no, both consistent with no public exploit identified at time of analysis. The high CVSS reflects worst-case impact if a usable XSS sink is reachable; the description, however, only asserts presence of a vulnerable library, not a confirmed exploitable path in BigFix's own code. Realistic priority is moderate for hardening but not emergency patching: this is a 'known-bad dependency' finding rather than confirmed actively exploited. Note: the CVE describes generic risk from the outdated library without naming the specific child CVE being inherited - defenders cannot fully validate exploitability without that mapping.

An attacker crafts a malicious URL or a poisoned endpoint hostname/configuration value that, when rendered in a BigFix SCM report by an authenticated operator, triggers a DOM-based XSS via a vulnerable jQuery 1.x selector or parseHTML sink. The injected script runs in the operator's browser session with full access to the reporting site, allowing exfiltration of compliance data or pivoting actions through the operator's authenticated session. No public exploit identified at time of analysis, so a tailored payload against a specific sink would need to be developed.