EUVD-2026-82765
GHSA-hg4r-cv5p-h5cm
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
Unauthenticated remote SSRF (AV:N/AC:L/PR:N/UI:N); absent evidence internal responses are returned I rate it blind (C:L) with S:U, as SSRF does not inherently cross a security scope.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
Lifecycle Timeline
2DescriptionCVE.org
HCL BigFix Service Management is affected by a Server-Side Request Forgery (SSRF) vulnerability in its search functionality, which could allow an attacker to force the application server to send requests to internal systems that are not accessible from the internet.
AnalysisAI
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make the application server issue requests to internal systems that are not reachable from the internet, potentially exposing internal APIs, admin interfaces, or cloud metadata services. The vendor scores this 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N), but our independent assessment places it lower: the scope-change and high-confidentiality components are contestable, and realistic impact depends on whether the deployment has internal routes worth abusing and on whether responses are reflected to the attacker. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network access to the BigFix Service Management application's search functionality, which per the CVSS vector (PR:N/UI:N) is unauthenticated and requires no user interaction; the practical prerequisite is that the instance (or at least its search feature) is reachable by the attacker. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) rates this Critical, but that score is heavily inflated by two contestable choices: the scope-change (S:C) and the C:H confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch was identified in the available data for this CVE - the only reference is HCL's support article KB0133782 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0133782), so the first step is to open that article and confirm whether HCL has published a fixed build or hotfix and apply it if so, or obtain an updated release through HCL support. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all HCL BigFix Service Management deployments, identify any internet-facing instances, and restrict access to them via VPN, firewall rules, or IP allowlisting; if operationally feasible, disable or restrict the search functionality, and block outbound traffic from application servers to internal RFC1918 addresses, loopback, and cloud metadata endpoints such as 169.254.169.254. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Inadequate account lockout controls in HCL BigFix Service Management allow unauthenticated remote attackers to conduct s
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's u
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one ten
HCL BigFix Service Management permits multiple simultaneous authenticated sessions for the same administrative account,
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly valida
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error mes
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today