EUVD-2026-82782
GHSA-h3cm-83xm-6m56
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Remote unauthenticated brute-force (AV:N/AC:L/PR:N/UI:N); I retain the vendor's conservative C:L/I:N/A:L for the raw weakness since full takeover depends on weak credentials, not the flaw alone.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
2DescriptionCVE.org
HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, which could allow an unauthenticated attacker to execute sustained brute-force attacks against the login interface, resulting in unauthorized system access.
AnalysisAI
Inadequate account lockout controls in HCL BigFix Service Management allow unauthenticated remote attackers to conduct sustained brute-force attacks against the login interface, potentially leading to unauthorized system access. The vulnerability (CWE-307) is remotely exploitable without authentication or user interaction (CVSS 3.1: AV:N/AC:L/PR:N/UI:N), but success is limited to weak, reused, or guessable credentials and is effectively mitigated by MFA, rate-limiting, IP throttling, or strong password policies. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the HCL BigFix Service Management login interface and the absence of compensating controls - the core prerequisite is that account lockout / rate limiting is not enforced (the vulnerability itself). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 3.1 vector (6.5, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) frames this as a remote, unauthenticated, low-complexity weakness with only partial confidentiality and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch status is not confirmed from the provided data; consult vendor advisory KB0133917 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133917) for patch availability, exact fixed versions, and upgrade instructions. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
A Boolean-based SQL injection vulnerability exists in HCL Unica that allows remote attackers to manipulate backend datab
SQL injection and cross-tenant data exposure flaws in HCL BigFix Service Management allow an attacker who can reach the
Command injection in HCL BigFix RunBookAI 11.2 allows authenticated remote attackers to execute arbitrary operating syst
HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation.
SQL injection in HCL Aftermarket DPC version 1.0.0 enables unauthenticated remote attackers to extract sensitive databas
Content Security Policy weakness in HCL Hive Telco Observability's Keycloak authentication component allows remote attac
Broken access control in HCL BigFix Service Management lets a low-privileged authenticated user reach administrative scr
Missing functional level access control in HCL Aftermarket DPC version 1.0.0 enables privilege escalation attacks that c
Cross-site scripting in HCL BigFix Service Management lets an attacker who already holds a valid low-privilege account (
Hardcoded credentials in HCL Aftermarket DPC version 1.0.0 enable authenticated low-privilege attackers with user intera
HCL Aftermarket DPC version 1.0.0 is vulnerable to unauthenticated file discovery that allows remote attackers to read s
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's u
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today