EUVD-2026-90879
GHSA-x257-rg92-3rpv
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed BigFix API endpoint
-
DeliverySend unauthenticated API request
-
ExploitEndpoint returns sensitive data
-
ExecutionHarvest data for reconnaissance
-
ImpactLeverage in follow-on attack
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires network reachability to the HCL BigFix Service Management API tier, where two specific API endpoints return sensitive data to callers without authentication (PR:N/UI:N). No special product feature toggle or non-default configuration is named in the description, so default deployments exposing these endpoints are affected. The principal limiting factor is network exposure: risk is materially higher when the BigFix Service Management interface is internet-facing and lower when it is restricted to an internal management network. Impact is bounded to confidentiality (C:L) - the flaw alone discloses data but does not modify data or cause outages. |
| Impact | The vendor-supplied CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM) describes a network-reachable, low-complexity, unauthenticated information-disclosure flaw with only low confidentiality impact and no integrity or availability impact. No EPSS score, CISA KEV listing, or public proof-of-concept is present in the supplied data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is best characterized as a reconnaissance/stepping-stone weakness rather than a direct compromise: the description itself frames the leaked data as enabling 'further, more serious attacks,' consistent with the C:L-only rating. There are no conflicting signals in the provided data - the vector and the description agree (remote, unauthenticated, confidentiality-limited). The main unknown is the exact nature of the two exposed endpoints and what sensitive data they return, which the single vendor KB reference does not disclose in the provided input. Treat as a medium-priority patch item, not an emergency, prioritized higher only where BigFix Service Management is internet-exposed. |
| Exploit ScenarioDerived | An unauthenticated attacker who can reach the BigFix Service Management web/API tier sends requests to the two affected API endpoints, which return sensitive data without requiring credentials. The attacker harvests this data (e.g., configuration, identifiers, or internal details) to map the environment and plan a follow-on, higher-impact attack. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 01, 2026
Information disclosure in HCL BigFix Service Management allows unauthenticated remote attackers to retrieve sensitive data from two exposed API endpoints, with no user interaction required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM). Only confidentiality is affected at a low level; the flaw does not permit data modification or cause denial of service on its own, but the leaked data can be used to stage follow-on attacks against the platform. There is no vendor-released fix identified in the available data, no public exploit code identified at time of analysis, and no confirmed active exploitation (not listed in CISA KEV); the practical risk is driven primarily by whether the BigFix Service Management API tier is reachable from untrusted networks.
RemediationAI
No vendor-released patched version is identified in the available data, so the first action is to consult HCL knowledge-base article KB0134015 (https://support.hcl-software.com/csm?id=kb_article&sysparm_article=KB0134015) for the vendor's confirmed affected builds, fixed build, and any hotfix, and to apply it as soon as it is published; if HCL has issued interim configuration guidance in that article, follow it rather than the generic measures below. Until a fix is applied, the most effective compensating control follows directly from the assessed attack path - the endpoints require no authentication and no user interaction, so exploitability collapses if the BigFix Service Management API tier is not reachable by untrusted clients. Restrict network exposure by firewalling the API tier to trusted management subnets or requiring VPN/ZTNA access, which removes internet-facing exposure with the trade-off that remote or off-network administrators and integrations lose direct connectivity. Where the affected endpoints can be identified, block them at a reverse proxy or WAF with an explicit deny rule; the trade-off is that legitimate consumers of those endpoints (reporting, dashboards, or third-party integrations) will break until patched, so stage the rule in log-only mode first to enumerate callers. Additionally, review API access logs for unauthenticated requests to these endpoints before the mitigation date, treat any such requests as potential credential or data harvesting, and rotate any secrets or tokens that may have been exposed through the disclosed data. Because impact is limited to confidentiality (C:L) with no integrity or availability effect, patch prioritization can be driven by exposure: internet-facing instances warrant urgent mitigation, while instances confined to a segmented internal management network carry materially lower risk.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is an information-exposure weakness classified as CWE-200, meaning the application returns sensitive information to an actor who should not have access to it. In this case the exposure vector is API surface rather than a memory-safety or injection flaw: two API endpoints in HCL BigFix Service Management respond with sensitive data to callers, and the assessed vector (PR:N/UI:N) indicates no authentication or interaction is required to reach them. The affected component set is described by the CPE cpe:2.3:a:hcl_software:hcl_bigfix_service_management:*:*:*:*:*:*:*:*, i.e. the vendor wildcard covers all tracked versions, so no single fixed build is distinguished in the supplied data. Because the impact is bounded to confidentiality (C:L) with Scope:Unchanged, the vulnerability class is best understood as an over-permissive read interface - endpoints lacking proper authorization or response filtering - rather than a defect that affects processing integrity. The developer-reported record (HCL) and the vendor knowledge-base article KB0134015 are the only references supplied.
Know when Hcl Bigfix Service Management gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Remote unauthenticated API access with no user interaction (AV:N/AC:L/PR:N/UI:N); impact limited to partial confidentiality disclosure (C:L) with no integrity or availability effect.
Primary rating from Vendor (HCL).
CVSS VectorVendor: HCL
DescriptionCVE.org
HCL BigFix Service Management is affected by an Information Disclosure vulnerability because two exposed API endpoints return sensitive data. This information could enable an attacker to launch further, more serious attacks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Interception of unencrypted HTTP traffic between backend services in HCL BigFix Service Management lets an on-path attac
Stored cross-site scripting in HCL BigFix Service Management lets an attacker persist malicious script inside the applic
Sustained brute-force attacks against the HCL BigFix Service Management v27 login interface are possible because the pro
Unrestricted file upload in HCL BigFix Service Management lets an attacker submit a crafted file through the product's u
Server-side request forgery in the search functionality of HCL BigFix Service Management allows remote attackers to make
An exposed API endpoint in HCL BigFix Service Management returns sensitive internal database information to remote, unau
Inspection of publicly served JavaScript in BigFix Service Management lets unauthenticated remote users discover hidden
HCL BigFix Service Management exposes internal IP addresses through its own HTTP responses - response headers, error mes
Cross-tenant data exposure in HCL BigFix Service Management allows an authenticated user with a valid account in one ten
Input validation failures in HCL BigFix Service Management allow remote attackers to inject malformed data into the appl
HCL BigFix Service Management ships with a CORS misconfiguration (CWE-942) in which Origin headers are improperly valida
Administrative session hijacking in HCL BigFix Service Management Version 27 stems from the product allowing multiple si
Exploit-DB