BigFix Service Management CVE-2026-67172

Requires that one or more of the affected BigFix Service Management API endpoints be network-reachable by the attacker, and that the application be running in a mode that returns detailed (non-sanitized) error output when it receives invalid input - the core precondition named in the description is simply that invalid inputs reach 'certain API endpoints' and the application responds with sensitive data in the error. Limiting factors: impact is confidentiality-only (C:L) with no write or execution capability; the vendor-assessed AC:H and SSVC 'Automatable: no' imply the useful data is not reliably or uniformly leaked, so success may depend on which endpoint and input are probed; value is limited to reconnaissance that facilitates further attacks rather than direct compromise.

This is a low-priority issue despite being network-reachable without authentication. The CVSS 3.1 base score of 3.7 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects limited, confidentiality-only impact (C:L) with no integrity or availability effect, and the vendor-assigned high attack complexity (AC:H) further constrains practical exploitation. All three SSVC signals agree with this low urgency: Exploitation is 'none' (no observed activity), Automatable is 'no', and Technical Impact is only 'partial'. No EPSS score was provided in the input, and the CVE is not listed in CISA KEV nor is any POC referenced, so there is no evidence of real-world exploitation. The only signal in tension is AV:N/PR:N, which makes the flaw remotely reachable by unauthenticated actors - but the payoff (verbose error-message data) is an information-leak that aids reconnaissance rather than a directly damaging primitive. Net: a genuine but minor hygiene issue, not an emergency; patch on a normal maintenance cycle.

An unauthenticated remote attacker sends deliberately malformed or invalid requests to specific HCL BigFix Service Management API endpoints and harvests the verbose error responses, which disclose sensitive internal details (such as stack traces, internal paths, component versions, or configuration data). The attacker uses this leaked information to fingerprint the environment and plan follow-on attacks against other weaknesses. No public exploit code is referenced, and exploitation yields only information disclosure, not code execution.