What is the CVSS score of CVE-2026-56620?

CVE-2026-56620 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

HCL BigFix Mobile CVE-2026-56620

EUVD-2026-55662 MEDIUM

Error Message Information Leak (CWE-209)

2026-08-10 HCL

GHSA-gvcf-x6qv-74p4

Information Disclosure Hcl Bigfix Mobile Hclsoftware

4.3

CVSS 3.1 · Vendor: HCL

Severity by source

Vendor (HCL) PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable endpoint requires only low-privileged authentication; impact is limited to partial confidentiality via error message leakage, with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (HCL).

CVSS VectorVendor: HCL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 16:33 vuln.today

DescriptionCVE.org

HCL BigFix Mobile is vulnerable to information disclosure due to improper handling of exceptions and verbose error reporting.

AnalysisAI

HCL BigFix Mobile leaks sensitive application internals through verbose error messages and improper exception handling, enabling authenticated network users to harvest stack traces, internal paths, or configuration details that materially assist reconnaissance. Confirmed by HCL under CVSS 4.3 (AV:N/AC:L/PR:L), the flaw requires only a low-privileged account to exploit and produces no integrity or availability impact - purely a confidentiality concern. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Technical ContextAI

CWE-209 (Generation of Error Message Containing Sensitive Information) describes a class of flaws where an application surfaces exception details - stack traces, internal file paths, library versions, framework identifiers, or partial configuration data - directly to end users rather than logging them server-side behind access controls. HCL BigFix Mobile is an enterprise mobile device management component of the broader HCL BigFix endpoint management platform, used by organizations to enroll, configure, and secure mobile endpoints. The CPE string cpe:2.3:a:hclsoftware:hcl_bigfix_mobile:*:*:*:*:*:*:*:* covers all versions without a lower-bound exclusion, indicating the error-handling deficiency is architectural and not version-specific. The CVSS AC:L metric confirms no special configuration or race condition is required to reach the vulnerable code path.

RemediationAI

Consult the HCL advisory at https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0132661 for the vendor-specified patch or configuration guidance; no specific fixed version number was available in the provided intelligence and should be verified directly against that KB article. As an interim compensating control, administrators should configure the BigFix Mobile application tier to suppress exception details from user-facing HTTP responses, routing full stack traces exclusively to server-side logs protected by role-based access controls - noting this may reduce diagnostic transparency for legitimate support workflows. Network segmentation or VPN enforcement limiting BigFix Mobile interface access to authorized internal users only further reduces the attack surface by constraining who can submit exception-triggering requests, though this does not address the root cause and should not substitute for patching.