HCL BigFix AEX CVE-2026-67074

The CVSS vector requires high privileges (PR:H), so exploitation presupposes an attacker already holding a privileged account or service-level access to HCL BigFix AEX; it is reachable over the network (AV:N) with low complexity (AC:L) and without user interaction (UI:N). The scope is changed (S:C), indicating impact can reach resources beyond the vulnerable component. The available sources do not describe the exact feature, endpoint, protocol, or configuration that carries the code-injection (CWE-94) trigger, so the precise injectable input path is unverified. The principal limiting factor is the privilege requirement: this is not exploitable by an unauthenticated/unprivileged remote attacker based on the supplied vector.

Signals are mixed and the single vendor reference carries almost all the weight. The vuln.today Decision label is act_now and the CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so severity is treated as critical and the network-reachable, low-complexity, scope-changing vector is genuinely serious. However, the vector requires high privileges (PR:H), meaning an already-authenticated/privileged account is a precondition - this is not a purely anonymous internet attack. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the act_now label therefore reflects vendor/priority judgement and the high CVSS rather than observed in-the-wild activity. The provided tag set includes 'Authentication Bypass', which conflicts with the PR:H vector (high privileges required) - these cannot both be fully true, so the authentication precondition should be verified against the HCL advisory. No SSVC automatable/technical-impact fields were supplied. Net: treat as a high-priority patch item because of the critical score, scope change, and act_now label, but note the PR:H requirement and the complete absence of exploitation-probability data (EPSS/KEV/PoC) temper the realistic likelihood of opportunistic mass exploitation.

An attacker who already holds a privileged account or service credential on an HCL BigFix AEX deployment sends crafted input that is interpreted as code (CWE-94), causing arbitrary code execution with the privileges of the AEX application or service. Because the CVSS scope is changed (S:C), the impact can extend beyond the vulnerable component to other resources. No public proof-of-concept or exploit code is referenced in the available data.