EUVD-2026-55668
GHSA-r4mg-mh8r-f4jx
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS requires low-privilege authentication (PR:L) and victim click interaction (UI:R); scope changes to victim's browser context (S:C) with limited confidentiality and integrity impact and no availability impact.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
1DescriptionCVE.org
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scripting (Reflected XSS) due to insufficient validation and output encoding of user-controlled input.
AnalysisAI
Reflected XSS in HCL BigFix Mobile allows authenticated attackers to inject and execute malicious scripts in the browsers of other authenticated users by crafting malicious URLs containing unsanitized payloads. The CVSS Scope:Changed attribute (S:C) indicates the injected script executes outside the vulnerable component's security boundary - enabling session hijacking, credential theft, or unauthorized administrative actions against higher-privileged victims. No public exploit code and no CISA KEV listing exist at time of analysis, though the vendor has self-disclosed via advisory KB0132661.
Technical ContextAI
HCL BigFix Mobile is an enterprise mobile device management (MDM) component within the HCL BigFix endpoint management ecosystem, used by organizations to manage and secure mobile endpoints. The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting'), specifically the reflected variant, meaning user-controlled input from HTTP request parameters or form fields is echoed back in server responses without adequate validation or output encoding. The browser then interprets the attacker-supplied content as executable script. The affected CPE (cpe:2.3:a:hclsoftware:hcl_bigfix_mobile:*:*:*:*:*:*:*:*) uses a wildcard version field, indicating no version floor or ceiling has been published in structured data - all deployed versions should be considered potentially vulnerable.
RemediationAI
Consult and apply the vendor patch referenced in HCL Software advisory KB0132661 at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132661 - the exact fixed version number was not present in the available data and must be confirmed directly from that article. While patching, restrict access to the HCL BigFix Mobile web interface to trusted internal networks or VPN-only segments, reducing the attacker's ability to deliver crafted URLs to victims across untrusted channels. Deploy a Web Application Firewall with XSS reflection detection rules as a compensating control; note WAF tuning is required to avoid false positives on legitimate requests. If the application framework supports it, enforce a strict Content-Security-Policy (CSP) header (e.g., script-src 'self') to block inline script execution even when injection succeeds - verify compatibility with BigFix Mobile's legitimate functionality before deploying. Brief administrative and privileged users on not clicking unsolicited links to the BigFix Mobile portal.
More in Hcl Bigfix Mobile
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today