BigFix Service Management CVE-2026-67105

Exploitation requires the attacker to already have internal network access and an on-path (man-in-the-middle) position on the network segment carrying HTTP traffic between HCL BigFix Service Management backend services, which run that inter-service communication over unencrypted HTTP rather than TLS. Limiting factors: the attacker must be positioned on the relevant internal segment (not remotely over the internet in a practical sense), sensitive data must actually be flowing on that channel during interception, and the high attack complexity (AC:H) reflects the need to achieve and maintain the on-path position. No authentication to the product and no user interaction are required once positioned.

The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N = 7.4) rates this HIGH, but the signals pull in different directions. The 'HIGH' score is driven by dual C:H/I:H impact, yet AC:H and the description's own wording ('attacker with internal network access') reveal a significant precondition: the attacker must already hold a privileged on-path position on the internal network segment carrying backend-to-backend traffic. This is not a remote, internet-facing, one-shot exploit despite PR:N/UI:N. Notably, the description describes classic adjacent/on-path man-in-the-middle interception, which conflicts with the vendor's AV:N (network) choice - a true MitM on local backend traffic is better modeled as AV:A (adjacent); verify network exposure with HCL. There is no EPSS score, no CISA KEV listing, and no public POC in the provided data, so no evidence of active or automated exploitation exists. SSVC-style reading: exploitation=none observed, automatable=no (requires positioning plus live sensitive traffic), technical impact=total for the intercepted channel. Net: a legitimate hardening/confidentiality issue worth remediating, but the AC:H positioning requirement and absence of exploitation signals place it below internet-facing unauthenticated RCEs in triage priority.

An attacker who has already gained a foothold on the internal network segment where HCL BigFix Service Management backend services communicate positions themselves on-path (e.g., via ARP spoofing or a compromised host) and passively captures the unencrypted HTTP traffic between those services. They extract sensitive data in transit - credentials, session tokens, or configuration - and can actively tamper with requests/responses to perform a man-in-the-middle attack. No public exploit code is identified at time of analysis; the attack relies on standard network interception tooling rather than a product-specific exploit.