HCL BigFix AEX CVE-2026-67080

Exploitation requires network reachability to the HCL BigFix AEX application together with low-privilege authentication (CVSS PR:L), so an attacker must already possess valid, if limited, credentials or an authenticated session - this is the primary limiting factor and means it is not a pre-auth, drive-by issue. The exact feature, endpoint, or configuration that triggers the verbose error output is not described in the available sources; the description states only that errors or exceptional conditions are improperly handled, exposing stack traces, system details, and internal paths. No user interaction is required (UI:N) and attack complexity is low (AC:L), so once authenticated the condition appears straightforward to reach, but the specific input needed to trigger it is unverified from the provided data.

This is a moderate-severity information-disclosure issue (CWE-209) rather than a top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) indicates a network-reachable flaw with low attack complexity that nonetheless requires some level of authentication (PR:L), and it affects confidentiality only (C:H) with no integrity or availability impact. The vuln.today decision label is 'this_month', which signals a routine prioritized fix rather than an act_now/emergency response. There is no CISA KEV listing, no EPSS probability was supplied, and no proof-of-concept or exploit reference is present - only a vendor knowledge-base advisory. Signals are therefore internally consistent and point to a real but non-urgent issue: the value of this bug to an attacker is primarily as a reconnaissance aid (stack traces, internal paths, system details) that facilitates follow-on exploitation, not as a standalone high-impact compromise. Note two caveats: the vector rates confidentiality as C:H, which is aggressive for error-message disclosure of technical metadata and may overstate real-world impact, and no EPSS score was provided, so widespread-exploitation likelihood cannot be quantified from the input.

A low-privileged but authenticated attacker who can reach the BigFix AEX application over the network sends requests that trigger error or exceptional conditions, causing the application to return verbose error output. The returned stack traces, internal file paths, and system details are then harvested to map the environment and plan further, more targeted attacks. No public exploit code or PoC reference was provided in the available data.