HCL BigFix AEX CVE-2026-21830

The flaw resides in the aws-sdk package bundled with HCL BigFix AEX V13.0 and manifests as AWS API requests being sent to unintended or non-AWS endpoints. The CVSS vector marks it unauthenticated and network-reachable (PR:N, UI:N, AV:N) but with high attack complexity (AC:H), indicating meaningful preconditions must align for exploitation; however, the specific feature, configuration setting, or input that must be attacker-controlled is not described in the available sources. Limiting factors are the high complexity, the confidentiality-only impact (C:L, no integrity or availability), and the narrow deployment footprint of the product.

This is a low-severity, low-priority issue, consistent across every available signal. The vendor-assigned CVSS is 3.7 (Low) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - network-reachable and unauthenticated, but high attack complexity and limited to a low confidentiality impact only (no integrity or availability impact). The vuln.today decision label is 'monitor', the weakest urgency tier, which aligns with the low CVSS. No EPSS score, no CISA KEV listing, and no public exploit were supplied, so there is no evidence of exploitation pressure. The signals are therefore mutually consistent rather than conflicting: a low-CVSS issue with no exploitation indicators. The one point worth verifying is the CWE-20/description framing versus the vector: the description (AWS API requests routed to unintended or non-AWS endpoints) suggests an endpoint-resolution/input-validation flaw whose real impact could include leakage of request data or credentials to an attacker-influenced endpoint, which the C:L rating already captures as limited. The AC:H metric is not explained by the sources, so the specific condition that makes exploitation complex is not stated in the available data.

An attacker who can influence the endpoint or region resolution inputs consumed by the bundled aws-sdk could cause BigFix AEX to send AWS API requests - potentially including request metadata or credentials - to a non-AWS endpoint under the attacker's control, enabling limited information disclosure. The high attack complexity (AC:H) indicates non-trivial preconditions must be met, and no public exploit was identified. The exact trigger is not described in the available sources.