EUVD-2026-44531
GHSA-95qg-pcpr-8wr9
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Timing enumeration requires authenticated low-privilege access (PR:L), precise measurement conditions (AC:H), and reveals only username existence (C:L); no integrity or availability impact applies.
Primary rating from Vendor (hcl).
CVSS VectorVendor: hcl
Lifecycle Timeline
1DescriptionCVE.org
HCL BigFix Platform is affected by a user enumeration vulnerability which might allow an attacker, through careful system control and response time monitoring, to perform some level of user enumeration for the BigFix service.
AnalysisAI
User enumeration via observable timing discrepancy in HCL BigFix Platform allows a low-privileged remote attacker to infer the existence of valid usernames by carefully measuring and comparing authentication response times. Affected versions span the 10.0 and 11.0 release branches. No public exploit code has been identified and CISA has not added this to the KEV catalog; exploitation probability is extremely low at 0.15% EPSS (5th percentile).
Technical ContextAI
CWE-208 (Observable Timing Discrepancy) describes a class of side-channel vulnerability in which an application leaks information through measurable differences in the time taken to process valid versus invalid inputs. In this case, the BigFix authentication service appears to handle requests for existing usernames differently - at the timing level - from requests for non-existent ones, allowing an attacker with authenticated access to probe the user database indirectly. HCL BigFix Platform is an enterprise endpoint management and patch management system. Affected CPE covers versions 10.0.0 through 10.0.15 and 11.0.0 through 11.0.5 as reported by EUVD.
RemediationAI
Consult the HCL PSIRT advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132093 for patch guidance. No specific fixed version number was present in the available data, so administrators should reference the KB article directly for the exact patched release. As a compensating control while patching is arranged, consider implementing rate limiting and request throttling on the BigFix authentication endpoint to increase the difficulty of reliable timing measurements. Adding artificial response-time normalization (constant-time comparison logic) is the correct long-term architectural fix, but absent a vendor patch, network-layer controls that introduce timing jitter or cap request rates per session can raise the attack complexity further. Restricting network access to the BigFix management interface to internal or VPN-only segments reduces exposure, since PR:L already limits this to authenticated users.
Same weakness CWE-208 – Observable Timing Discrepancy
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today